181 Web Spoofing

8/6/2019 181 Web Spoofing

1/34

www.seminarcollections.com IP & WEB SPOOFING

1.0 INTRODUCTION

This paper describes an Internet security attack that could endanger the

privacy of World Wide Web users and the integrity of their data. The attack can

be carried out on today's systems, endangering users of the most common Web

browsers, including Netscape Navigator and Microsoft Internet Explorer.

1.1HISTORY

The concept of IP spoofing was initially discussed in academic circles in

the 1980's. It was primarily theoretical until Robert Morris, whose son wrote the

first Internet Worm, discovered a security weakness in the TCP protocol known

as sequence prediction. Another infamous attack, Kevin Mitnick's Christmas

day, crack of Tsutomu Shimomura's machine, employed the IP spoofing and

TCP sequence prediction techniques. While the popularity of such cracks has

decreased due to the demise of the services they exploited, spoofing can still be

used and needs to be addressed by all security administrators.

1.2WHAT IS SPOOFING?

Spoofing means pretending to be something you are not. In Internet

terms it means pretending to be a different Internet address from the one you

really have in order to gain something. That might be information like credit

card numbers, passwords, personal information or the ability to carry out

actions using someone elses identity.

IP spoofing attack involves forging one's source address. It is the act of

using one machine to impersonate another. Most of the applications and tools in

web rely on the source IP address authentication. Many developers have used

Dept. of CSE www.seminarcollections.com1


2/34


the host based access controls to secure their networks. Source IP address is a

unique identifier but not a reliable one. It can easily be spoofed.

Web spoofing allows an attacker to create a "shadow copy" of the entire

World Wide Web. Accesses to the shadow Web are funneled through the

attacker's machine, allowing the attacker to monitor the all of the victim's

activities including any passwords or account numbers the victim enters. The

attacker can also cause false or misleading data to be sent to Web servers in the

victim's name, or to the victim in the name of any Web server. In short, the

attacker observes and controls everything the victim does on the Web.

The various types of spoofing techniques that we discuss include TCP

Flooding, DNS Server Spoofing Attempts, web site names, email ids and link

redirection.



3/34


2.0 WEB SPOOFING

2.1 INTRODUCTION








2.2 SPOOFING ATTACKS

In a spoofing attack, the attacker creates misleading context in order to

trick the victim into making an inappropriate security-relevant decision. A

spoofing attack is like a con game: the attacker sets up a false but convincing

world around the victim. The victim does something that would be appropriate

if the false world were real. Unfortunately, activities that seem reasonable in the

false world may have disastrous effects in the real world.

Spoofing attacks are possible in the physical world as well as the

electronic one. For example, there have been several incidents in which

criminals set up bogus automated-teller machines, typically in the public areas

of shopping malls. The machines would accept ATM cards and ask the person

to enter their PIN code. Once the machine had the victim's PIN, it could either

eat the card or "malfunction" and return the card. In either case, the criminals

had enough information to copy the victim's card and use the duplicate. In these



4/34


attacks, people were fooled by the context they saw: the location of the

machines, their size and weight, the way they were decorated, and the

appearance of their electronic displays.

People using computer systems often make security-relevant decisions

based on contextual cues they see. For example, one might decide to type in

your bank account number because he/she believes you are visiting your bank's

Web page. This belief might arise because the page has a familiar look, because

the bank's URL appears in the browser's location line, or for some other reason.

To appreciate the range and severity of possible spoofing attacks, we

must look more deeply into two parts of the definition of spoofing: security-

relevant decisions and context.

2.2.1 Security-relevant Decisions

By "security-relevant decision," we mean any decision a person makes

that might lead to undesirable results such as a breach of privacy or

unauthorized tampering with data. Deciding to divulge sensitive information,

for example by typing in a password or account number, is one example of a

security-relevant decision. Choosing to accept a downloaded document is a

security-relevant decision, since in many cases a downloaded document is

capable of containing malicious elements that harm the person receiving the

document.

Even the decision to accept the accuracy of information displayed by

ones computer can be security-relevant. For example, if one decide to buy a

stock based on information one get from an online stock ticker, he/she is

trusting that the information provided by the ticker is correct. If somebody



5/34


could present some incorrect stock prices, they might cause the victim to

engage in a transaction that the person would not have otherwise made.

2.2.2 Context

A browser presents many types of context that users might rely on to

make decisions. The text and pictures on a Web page might give some

impression about where the page came from; for example, the presence of a

corporate logo implies that the page originated at a certain corporation.

The names of objects can convey context. People often deduce what is in

a file by its name. Is manual.doc the text of a user manual? (It might be another

kind of document, or it might not be a document at all.) URLs are another

example. Is MICR0S0FT.COM the address of a large software company? (For

a while that address pointed to someone else entirely. By the way, the round

symbols in MICR0S0FT here are the number zero, not the letter O.).

People often get context from the timing of events. If two things happen

at the same time, you naturally think they are related. If you click over to your

bank's page and a username/password dialog box appears, you naturally assume

that you should type the name and password that you use for the bank. If you

click on a link and a document immediately starts downloading, you assume

that the document came from the site whose link you clicked on. Either

assumption could be wrong.

If you only see one browser window when an event occurs, you might

not realize that the event was caused by another window hiding behind the

visible one.

Modern user-interface designers spend their time trying to devise

contextual cues that will guide people to behave appropriately, even if they do



6/34


not explicitly notice the cues. While this is usually beneficial, it can become

dangerous when people are accustomed to relying on context that is not always

correct.

2.3 WEB SPOOFING

Web spoofing is a kind of electronic con game in which the attacker

creates a convincing but false copy of the entire World Wide Web. The false

Web looks just like the real one: it has all the same pages and links. However,

the attacker controls the false Web, so that all network traffic between the

victim's browser and the Web goes through the attacker.

Consequences Since the attacker can observe or modify any data going from

the victim to Web servers, as well as controlling all return traffic from

Web servers to the victim, the attacker has many possibilities. These

includesurveillance and tampering.

Surveillance The attacker can passively watch the traffic, recording which

pages the victim visits and the contents of those pages. When the victim fills

out a form, the entered data is transmitted to a Web server, so the attacker can

record that too, along with the response sent back by the server. Since most on-

line commerce is done via forms, this means the attacker can observe any

account numbers or passwords the victim enters.

The attacker can carry out surveillance even if the victim has a "secure"

connection (usually via Secure Sockets Layer) to the server, that is, even if the

victim's browser shows the secure-connection icon (usually an image of a lock

or a key).



7/34


Tampering The attacker is also free to modify any of the data traveling in

either direction between the victim and the Web. The attacker can modify form

data submitted by the victim. For example, if the victim is ordering a product

on-line, the attacker can change the product number, the quantity, or the ship-to

address.

The attacker can also modify the data returned by a Web server, for

example by inserting misleading or offensive material in order to trick the

victim or to cause antagonism between the victim and the server.

2.3.1 Spoofing the Whole Web

You may think it is difficult for the attacker to spoof the entire World

Wide Web, but it is not. The attacker need not store the entire contents of the

Web. The whole Web is available on-line; the attacker's server can just fetch a

page from the real Web when it needs to provide a copy of the page on the false

Web.

2.3.2 How the Attack Works

The key to this attack is for the attacker's Web server to sit between the

victim and the rest of the Web. This kind of arrangement is called a "man in the

middle attack" in the security literature.

2.3.3 URL Rewriting

The attacker's first trick is to rewrite all of the URLs on some Web page

so that they point to the attacker's server rather than to some real server.

Assuming the attacker's server is on the machine www.attacker.org, the attacker

rewrites a URL by adding http://www.attacker.org to the front of the URL. For



8/34


example, http://home.netscape.com becomes

http://www.attacker.org/http://home.netscape.com.

The victim's browser requests the page from www.attacker.org, since the

URL starts with http://www.attacker.org. The remainder of the URL tells the

attacker's server where on the Web to go to get the real document.

Once the attacker's server has fetched the real document needed to

satisfy the request, the attacker rewrites all of the URLs in the document into

the same special form by splicing http://www.attacker.org/ onto the front. Then

the attacker's server provides the rewritten page to the victim's browser.

Since all of the URLs in the rewritten page now point to

www.attacker.org, if the victim follows a link on the new page, the page will

again be fetched through the attacker's server. The victim remains trapped in the

attacker's false Web, and can follow links forever without leaving it.



9/34


2.3.4 Forms

If the victim fills out a form on a page in a false Web, the result appears

to be handled properly. Spoofing of forms works naturally because forms are

integrated closely into the basic Web protocols: form submissions are encoded

in URLs and the replies are ordinary HTML. Since any URL can be spoofed,

forms can also be spoofed.

When the victim submits a form, the submitted data goes to the attacker's

server. The attacker's server can observe and even modify the submitted data,

doing whatever malicious editing desired, before passing it on to the real server.

The attacker's server can also modify the data returned in response to the form

submission.

2.3.5 "Secure" connections don't help

One distressing property of this attack is that it works even when the

victim requests a page via a "secure" connection. If the victim does a "secure"

Web access (a Web access using the Secure Sockets Layer) in a false Web,

everything will appear normal: the page will be delivered, and the secure

connection indicator (usually an image of a lock or key) will be turned on.



10/34


What is SSL?

SSL stands for Secure Sockets Layer. This protocol, designed by

Netscape Communications Corp., is used to send encrypted HTTP (Web)

transactions.

Seeing "https" in the URL box on your browser means SSL is being used

to encrypt data as it travels from your browser to the server. This helps protect

sensitive information--social security and credit card numbers, bank account

balances, and other personal information--as it is sent.

The victim's browser says it has a secure connection because it does have

one. Unfortunately the secure connection is to www.attacker.org and not to the

place the victim thinks it is. The victim's browser thinks everything is fine: it

was told to access a URL at www.attacker.org so it made a secure connection to

www.attacker.org. The secure-connection indicator only gives the victim a false

sense of security.

2.3.5 Starting the Attack

To start an attack, the attacker must somehow lure the victim into the

attacker's false Web. There are several ways to do this.

1) An attacker could put a link to a false Web onto a popular Web page.

2) If the victim is using Web-enabled email, the attacker could email the

victim a pointer to a false Web, or even the contents of a page in a

false Web.

3) Finally, the attacker could trick a Web search engine into indexing

part of a false Web.

2.3.6 An example from real life



11/34


12/34


attack is going on. However, it is possible for the attacker to eliminate virtually

all of the remaining clues of the attack's existence.

Such evidence is not too hard to eliminate because browsers are very

customizable. The ability of a Web page to control browser behavior is often

desirable, but when the page is hostile it can be dangerous.

Another artifact of this kind of attack is that the pages returned by the

hacker intercept are stored in the users browser cache, and based on the

additional actions taken by the user; the spoofed pages may live on long after

the session is terminated.

2.4.1 The Status Line

The status line is a single line of text at the bottom of the browser

window that displays various messages, typically about the status of pending

Web transfers.

The attack as described so far leaves two kinds of evidence on the status

line. First, when the mouse is held over a Web link, the status line displays the

URL the link points to. Thus, the victim might notice that a URL has been

rewritten. Second, when a page is being fetched, the status line briefly displays

the name of the server being contacted. Thus, the victim might notice that

www.attacker.org is displayed when some other name was expected.

The attacker can cover up both of these cues by adding a JavaScript

program to every rewritten page. Since JavaScript programs can write to the

status line, and since it is possible to bind JavaScript actions to the relevant

events, the attacker can arrange things so that the status line participates in the



13/34


con game, always showing the victim what would have been on the status line

in the real Web. Thus the spoofed context becomes even more convincing.

2.4.2 The Location Line

The browser's location line displays the URL of the page currently being

shown. The victim can also type a URL into the location line, sending the

browser to that URL. The attack as described so far causes a rewritten URL to

appear in the location line, giving the victim a possible indication that an attack

is in progress.

This clue can be hidden using JavaScript. A JavaScript program can hide

the real location line and replace it by a fake location line which looks right and

is in the expected place. The fake location line can show the URL the victim

expects to see. The fake location line can also accept keyboard input, allowing

the victim to type in URLs normally. Typed-in URLs can be rewritten by the

JavaScript program before being accessed.



14/34


2.4.3 Viewing the Document Source

There is one clue that the attacker cannot eliminate, but it is veryunlikely to be noticed.

By using the browser's "view source"feature, the victim can look at the

HTML source for the currently displayed page. By looking for rewritten URLs

in the HTML source, the victim can spot the attack. Unfortunately, HTML

source is hard for novice users to read, and very few Web surfers bother to look

at the HTML source for documents they are visiting, so this provides very little

protection.

A related clue is available if the victim chooses the browser's "view

document information"menu item. This will display information including the

document's real URL, possibly allowing the victim to notice the attack. As

above, this option is almost never used so it is very unlikely that it will provide

much protection.

2.4.4 Bookmarks

There are several ways the victim might accidentally leave the attacker's

false Web during the attack. Accessing a bookmark or jumping to a URL by

using the browser's "Open location" menu item might lead the victim back into

the real Web. The victim might then reenter the false Web by clicking the

"Back" button. We can imagine that the victim might wander in and out of one

or more false Webs. Of course, bookmarks can also work against the victim,

since it is possible to bookmark a page in a false Web. Jumping to such a

bookmark would lead the victim into a false Web again.

2.5 WEB SPOOFING DEMONSTRATION



15/34


The HTML Source Code

Web Spoofing Demonstration

Spoofing

In both the cases below, if you mouse-over the link below, you'll see

http://basement.dartmouth.edu" in the status line at the bottom of your screen.

If you click on it, and you're not susceptible, then you'll actually go

there.

If you click on it, and you are susceptible, then we'll pop open a new

window for you.

Click here to see a spoof, if you're

configured correctly.

Click here to see the real basement

site



16/34


The HTML Page as seen

Spoofing

In both the cases below, if you mouse-over the link below, you'll see

"http://basement.dartmouth.edu" in the status line at the bottom of your screen.

If you click on it, and you're not susceptible, then you'll actually go there.

If you click on it, and you are susceptible, then we'll pop open a new window

for you.

Click here to see a spoof, if you're configured correctly.

Click here to see the real basement site

2.6 TRACING THE ATTACKER

Some people have suggested that this attack can be deterred by finding

and punishing the attacker. It is true that the attacker's server must reveal its

location in order to carry out the attack, and that evidence of that location will

almost certainly be available after an attack is detected.

Unfortunately, this will not help much in practice because attackers will

break into the machine of some innocent person and launch the attack there.

Stolen machines will be used in these attacks.

2.6.1 Remedies

Web spoofing is a dangerous and nearly undetectable security attack that

can be carried out on today's Internet. Fortunately there are some protective

measures you can take.

http://basement.dartmouth.edu/http://basement.dartmouth.edu/http://basement.dartmouth.edu/http://basement.dartmouth.edu/


17/34


2.6.2 Short-term Solution

In the short run, the best defense is to follow a three-part strategy:

1. disable JavaScript in your browser so the attacker will be unable to hide

the evidence of the attack;

2. make sure your browser's location line is always visible;

3. pay attention to the URLs displayed on your browser's location line,

making sure they always point to the server you think you're connected

to.

This strategy will significantly lower the risk of attack, though you could

still be victimized if you are not conscientious about watching the location line.

At present, JavaScript, ActiveX, and Java all tend to facilitate spoofing and

other security attacks, so we recommend that you disable them. Doing so will

cause you to lose some useful functionality, but you can recoup much of this

loss by selectively turning on these features when you visit a trusted site that

requires them.

2.6.3 Long-term Solution

We do not know of a fully satisfactory long-term solution to this

problem. Changing browsers so they always display the location line would

help, although users would still have to be vigilant and know how to recognize

rewritten URLs.

For pages that are not fetched via a secure connection, there is not much

more that can be done.

For pages fetched via a secure connection, an improved secure-

connection indicator could help. Rather than simply indicating a secure



18/34


connection, browsers should clearly say who is at the other end of the

connection. This information should be displayed in plain language, in a

manner intelligible to novice users; it should say something like "Microsoft

Inc." rather than "www.microsoft.com."

Every approach to this problem seems to rely on the vigilance of Web

users. Whether we can realistically expect everyone to be vigilant all of the time

is debatable.

3.0 IP SPOOFING

3.1 TCP FLOODING

3.1.1 Introduction

When a system (called the client) attempts to establish a TCP connection

to a system providing a service (the server), the client and server exchange a set

sequence of messages. This connection technique applies to all TCP connec-

tions-telnet, Web, email, etc.

Examining the IP header, we can see that the first 12 bytes (or the top 3

rows of the header) contain various information about the packet. The next 8



19/34


bytes (the next 2 rows), however, contains the source and destination IP

addresses. Using one of several tools, an attacker can easily modify these

addresses specifically the source address field. It's important to note that

each datagram is sent independent of all others due to the stateless nature of IP.

The client system begins by sending a SYN message to the server. The

server then acknowledges the SYN message by sending SYN-ACK message to

the client. The client then finishes establishing the connection by responding

with an ACK message. The connection between the client and the server is then

open, and the service-specific data can be exchanged between the client and the

server.

Here is a view of this message flow:

Client Server

------ ------

SYN-------------------->

Client and server can now send service-specific data

TCP uses sequence numbers. When a virtual circuit establishes

between two hosts, then TCP assigns each packet a number as an identifying

index. Both hosts use this number for error checking and reporting. Rik Farrow,

in his article "Sequence Number Attacks", explains the sequence number

system as follows:

"The sequence number is used to acknowledge receipt of data. At the beginning

of a TCP connection, the client sends a TCP packet with an initial sequence

number, but no acknowledgment. If there is a server application running at the

other end of the connection, the server sends back a TCP packet with its own

initial sequence number, and an acknowledgment; the initial number from the



20/34


client's packet plus one. When the client system receives this packet, it must

send back its own acknowledgment; the server's initial sequence number plus

one."

Thus an attacker has two problems:

1) He must forge the source address.

2) He must maintain a sequence number with the target.

The second task is the most complicated task because when target sets

the initial sequence number, the attacker must response with the correct

response. Once the attacker correctly guesses the sequence number, he can then

synchronize with the target and establish a valid session.

3.1.2 Services vulnerable to IP Spoofing:

Configuration and services that are vulnerable to IP spoofing:

RPC (Remote Procedure Call services)

Any service that uses IP address authentication

The X Window system

The R services suite (rlogin, rsh, etc.)

3.1.3 TCP and IP spoofing Tools:

1) Mendax for Linux

Mendax is an easy-to-use tool for TCP sequence number prediction and rshd

spoofing.

2)spoofit.h

spoofit.h is a nicely commented library for including IP spoofing functionality

into your programs. [Current URL unknown. -Ed.]

http://rootshell.com/archive-j457nxiqi3gq59dv/199711/mendax_linux.tgzhttp://air.csc.ncsu.edu/xzhao/docs/DogPack/spoofers/sp/spoofit.hhttp://rootshell.com/archive-j457nxiqi3gq59dv/199711/mendax_linux.tgzhttp://air.csc.ncsu.edu/xzhao/docs/DogPack/spoofers/sp/spoofit.h


21/34


3) ipspoof

ipspoofis a TCP and IP spoofing utility.

4) hunt

hunt is a sniffer which also offers many spoofing functions.

5) dsniff

dsniff is a collection of tools for network auditing and penetration testing.

dsniff, filesnarf, mailsnarf, msgsnarf, urlsnarf, and webspy passively monitor a

network for interesting data (passwords, e-mail, files, etc.). arpspoof, dnsspoof,

and macof facilitate the interception of network traffic.

3.2 DESCRIPTION

3.2.1 TCP Flags

Flags are used to manage the establishment and shutdown of a virtual

circuit

o SYN: request for the synchronization of syn/ack numbers (used in

connection setup)

o ACK: states that the acknowledgment number is valid (all segments in a

virtual circuit have this flag set, except for the first one)

o FIN: request to shutdown one stream

o RST: request to immediately reset the virtual circuit.

3.2.2 TCP Virtual Circuit: Setup

Aserver, listening to a specificport, receives a connection request from

a client: The segment containing the request is marked with the SYN flag

and contains a random initial sequence numbersc

The server answers with a segment marked with both the SYNandACK

flags and containing

http://www.ryanspc.com/spoof/ipspoof.chttp://www.ryanspc.com/sniffers/hunt-1.3.tgzhttp://www.monkey.org/~dugsong/dsniff/http://www.ryanspc.com/spoof/ipspoof.chttp://www.ryanspc.com/sniffers/hunt-1.3.tgzhttp://www.monkey.org/~dugsong/dsniff/


22/34


o an initial random sequence numberss

o sc + 1 as the acknowledgment number

The client sends a segment with the ACK flag set and with

sequence numbersc+ 1 and acknowledgment numberss+ 1.

3.2.3 TCP Virtual Circuit: Data Exchange

A partner sends in each packet the acknowledgment of the previous

segment and its own sequence number increased by the number of

transmitted bytes

A partner accepts a segment from the other partner only if the numbers

match the expected ones

An empty segment may be used to acknowledge the received data.



23/34


The potential for abuse arises at the point where the server system has

sent an acknowledgment (SYN-ACK) back to client but has not yet received the

ACK message. This is what we mean by half-open connection. The server has

built in its system memory a data structure describing all pending connections.

This data structure is of finite size, and it can be made to overflow by

intentionally creating too many partially-open connections.

Creating half-open connections is easily accomplished with IP spoofing.

The attacking system sends SYN messages to the victim server system; these

appear to be legitimate but in fact reference a client system that is unable to



24/34


respond to the SYN-ACK messages. This means that the final ACK message

will never be sent to the victim server system.

The half-open connections data structure on the victim server system

will eventually fill; then the system will be unable to accept any new incoming

connections until the table is emptied out. Normally there is a timeout

associated with a pending connection, so the half-open connections will

eventually expire and the victim server system will recover. However, the

attacking system can simply continue sending IP-spoofed packets requesting

new connections faster than the victim system can expire the pending

connections.

In most cases, the victim of such an attack will have difficulty in

accepting any new incoming network connection. In these cases, the attack does

not affect existing incoming connections nor the ability to originate outgoing

network connections. However, in some cases, the system may exhaust

memory, crash, or be rendered otherwise inoperative.



25/34


The location of the attacking system is obscured because the source

addresses in the SYN packets are often implausible. When the packet arrives at

the victim server system, there is no way to determine its true source. Since the

network forwards packets based on destination address, the only way to validate

the source of a packet is to use input source filtering.

3.3 IMPACT

Systems providing TCP-based services to the Internet community may

be unable to provide those services while under attack and for some time after

the attack ceases. The service itself is not harmed by the attack; usually only the

ability to provide the service is impaired.

In some cases, the system may exhaust memory, crash, or be rendered

otherwise inoperative.

3.3.1 TCP Virtual Circuit: Shutdown



26/34


One of the partners, say A, can terminate its stream by sending a

segment with the FIN flag set

The other partner, say B, answers with an ACK segment

From that point on, A will not send any data to B: it will just

acknowledge data sent by B

When B shutdowns its stream the virtual circuit is considered closed.

3.3.2 TCP Spoofing

Node A trusts node B (e.g., login with no password)

Node C wants to impersonate B with respect to A in opening a

TCP connection

C kills B (flooding, crashing, redirecting) so that B does not send

annoying RST segments

C sends A a TCP SYN segment in a spoofed IP packet with Bs address

as the source IP andsc as the sequence number

A replies with a TCP SYN/ACK segment to B with ss as the sequence

number. B ignores the segment: dead or too busy



27/34


C does not receive this segment but to finish the handshake it has to send

an ACK segment withss + 1 as the acknowledgment number

o C eavesdrops the SYN/ACK segment

o C guesses the correct sequence number

3.4 REDUCING IP SPOOFED PACKETS

3.4.1 Be Un-trusting and Un-trustworthy

One easy solution to prevent this attack is not to rely on address-based

authentication. Disable all the r* commands, remove all .rhosts files and empty

out the /etc/hosts.equiv file. This will force all users to use other means of

remote access (telnet, ssh, skey, etc).

3.4.2 Packet Filtering

With the current IP protocol technology, it is impossible to eliminate IP-

spoofed packets. However, you can take steps to reduce the number of IP-

spoofed packets entering and exiting your network.

Currently, the best method is to install a filtering router that restricts the

input to your external interface (known as an input filter) by not allowing a

packet through if it has a source address from your internal network. In

addition, you should filter outgoing packets that have a source address different

from your internal network to prevent a source IP spoofing attack from

originating from your site.



28/34


The combination of these two filters would prevent outside attackers

from sending you packets pretending to be from your internal network. It

would also prevent packets originating within your network from

pretending to be from outside your network. These filters will *not*

stop all TCP SYN attacks, since outside attackers can spoof packets from

*any* outside network, and internal attackers can still send attacks

spoofing internal addresses.

3.4.3 Cryptographic Methods

An obvious method to deter IP-spoofing is to require all network traffic

to be encrypted and/or authenticated. While several solutions exist, it will be a

while before such measures are deployed as defacto standards.

3.4.4 Initial Sequence Number Randomizing

Since the sequence numbers are not chosen randomly (or incremented

randomly) this attack works. Bellovin describes a fix for TCP that involves

partitioning the sequence number space. Each connection would have its own

separate sequence number space. The sequence numbers would still be

incremented as before, however, there would be no obvious or implied

relationship between the numbering in these spaces. Suggested is the following

formula:

ISN=M+F(localhost,localport,remotehost,remoteport)

Where M is the 4 microsecond timer and F is a cryptographic hash. F

must not be computable from the outside or the attacker could still guess

sequence numbers. Bellovin suggests F be a hash of the connection-id and a

secret vector (a random number, or a host related secret combined with the

machine's boot time).



29/34




30/34


31/34


5.0 CONCLUSION

When the world has started calling this era as the era of Internet A

World Wide Web that connects the every nook and corner of the globe we

should never be let behind because of some pestering security problems.

Spoofing of the Web and IP has over the years proved to be annoying as

well as dangerous. In this tense scenario it is mandatory that we stick onto the

various solutions so far available and at the same time spend our sincere efforts

in devising better plans to solve this menace. Indeed techniques like Packet

Filtering and Cryptographic techniques help to some extend but their efficiency

is limited. We still rely on manual security checks of the status line, location

line etc. which indeed are quite ineffective and practical.

The whole problem basically exists in that most of the web applications

and tools rely on the source IP address authentication. Alternatives are to be

derived and a better safer Internet should solve the problem of Spoofing.

---------------------------------



32/34


6.0 REFERENCES

IP Spoofing

1. www.cert.org

2. www.securityfocus.com

3. www.webopedia.com

4. www.linuxgazatte.com

5. www.networkice.com

Web Spoofing

1. www.cs.princeton.edu

2. www.cs.dartmouth.edu

3. www.fbi.gov

4. www.systemexperts.com

5. www.spoonybard.nu



33/34


ABSTRACT

This paper describes an Internet security attack that could endanger the

privacy of World Wide Web users and the integrity of their data. The attack can

be carried out on today's systems, endangering users of the most common Web

browsers, including Netscape Navigator and Microsoft Internet Explorer.

Spoofing means pretending to be something you are not. In Internet

terms it means pretending to be a different Internet address from the one you

really have in order to gain something. That might be information like credit

card numbers, passwords, personal information or the ability to carry out

actions using someone elses identity. IP spoofing attack involves forging one's

source address. It is the act of using one machine to impersonate another.










34/34


CONTENTS

1.0INTRODUCTION

1.1HISTORY

1.2WHAT IS SPOOFING?

2.0WEB SPOOFING

2.1INRTODUCTION

2.2SPOOFING ATTACKS

2.3WEB SPOOFING

2.4COMPLETING THE ILLUSION

2.5WEB SPOOFING DEMONSTRATION

2.6TRACING THE ATTACKER

3.0IP SPOOFING

3.1TCP FLOODING

3.2DESCRIPTION

3.3IMPACT

3.4REDUCING IP SPOOFED PACKETS

4.0DNS SPOOFING ATTACKS

5.0CONCLUSION

6.0REFERENCES

Date post:	07-Apr-2018
Category:	Documents
Upload:	vj-tauruz
View:	234 times
Download:	1 times

181 Web Spoofing

Documents