1 / 31

Sniffing and Session Hijacking

Sniffing and Session Hijacking. Lesson 12. Session Hijacking. Passive Attacker hijacks a session, but just sits back and watches and records all of the traffic that is being sent back and forth Also referred to as “sniffing” Active Attacker finds an active session and takes over.

ghita
Download Presentation

Sniffing and Session Hijacking

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Sniffing and Session Hijacking Lesson 12

  2. Session Hijacking • Passive • Attacker hijacks a session, but just sits back and watches and records all of the traffic that is being sent back and forth • Also referred to as “sniffing” • Active • Attacker finds an active session and takes over. • Done by forcing one of the parties offline, where the user can no longer communicate – usually done with a Denial of Service attack.

  3. Sniffing • Sniffers are programs or HW devices that monitor (“listen in to”) traffic flowing across a network. • They can pull in all packets or be selective and only grab packets destined for certain addresses or that carry a certain type of traffic • For a sniffer to work correctly, it needs to view all of the traffic going across a network. Thus, it must be on internal network or on main connection into/out of a network.

  4. Computer Network Monitoring • Port Scanning • Keystroke Monitoring • Packet sniffers • takes advantage of “friendly” nature of net. • Grabs packets not destined for system • used by • hackers • sysadmins • Law enforcement agencies

  5. IP Packet 4 8 16 19 32 Version Length Type of Srvc Total Length Identification Flags Fragment Offset Time to live Protocol Header Checksum Source Address Destination Address Options Data

  6. SnifferPro

  7. SnifferPro

  8. SnifferPro

  9. SnifferPro

  10. NetXray

  11. TCP packet 4 8 16 32 Source Port Destination Port Sequence Number Acknowledgement Number Unused U A P R S F R C S S Y I G K H T NN Window Data offset Checksum Urgent Pointer Options Padding Data

  12. NetXray

  13. Van Eck reception • Relies on the fact that electronic equipment radiates electromagnetic signals which can be intercepted • With the proper equipment signals can be recreated up to 1 kilometer away

  14. Seizing the Signals • Eavesdropping on conversations • “listening in”, the content • Traffic analysis • data about the signals themselves

  15. Eavesdropping • Cellular Intercepts • extremely vulnerable to interception • Pager Intercepts • also fairly simple • Law Enforcement Wiretaps • generally require court order with probable cause • Foreign Intelligence Intercepts • US and others have VERY active program in this arena

  16. ECHELON

  17. Sniffing VoIP sessions

  18. Defeating Sniffer Attacks • Detecting and Eliminating Sniffers • Possible on a single box if you have control of the system • Difficult (depending on OS) to impossible (if somebody splices network and adds hardware) from network perspective • Safer Topologies • Sniffers capture data from network segment they are attached to, so – create segments • Encryption • If you sniff encrypted packets, who cares? • (outside of traffic analysis, of course)

  19. Traffic Analysis • Looks at activity, not contents • Pen Registers and Tap & Trace • pen registers provides access to the numbers that are dialed from a phone • tap & trace provides incoming numbers • Location Tracking • possible with cellular phones • can work even when phone not in use

  20. ACK (SN-S+1) SYN (SN-U) SYN(SN-S),ACK(SN-U+1) Session Hijacking • Review for a second, the three-way handshake in TCP: User Server

  21. Revisit Sequence Numbers • Depending on the session to be hijacked, you may or may not be able to observe the traffic and thus know the sequence number. • Sequence numbers are • 32-bit numbers, • Used by recipient to know what order to put received packets in, and • To acknowledge packets received so sender knows if it has to resend a packet. • There is one for the sender and one for the receiver

  22. Steps in Session Hijacking • Find a target • Perform sequence number prediction • Find an active session • Guess the sequence numbers • Take one of the parties offline • Take over the session

  23. Find a target • Need to find a suitable target • Need to be able to sample sequence numbers • Need to be able to get through the firewall for this • Needs to have connected sessions • Probably should be a server that allows session-oriented connections (e.g. telnet or FTP)

  24. Perform sequence number prediction • If you can view the traffic, no problem… • Predictability of sequence number depends on OS (Windows more predictable) • Use scanning tool to determine OS (e.g. nmap) • Attempt several connections and observe sequence numbers to see how random the sequence is – gather information.

  25. Find an Active Session • In session hijacking you want to take over a session – you want somebody to be around • This is opposite of usual hacker activity where you don’t want folks around to notice activity • The more traffic the better off since there will less chance of somebody noticing (individual may assume heavy traffic is causing them any network problems experienced)

  26. Guess the sequence number • For communication to occur need several things: • IP address (doesn’t change during session) • Port number (doesn’t generally change) • Sequence number (changes each packet sent) • Thus, attacker must successfully guess sequence number to hijack session • Goal is to get server to accept packet sent, take some educated guessing based on knowledge of sequence predictability

  27. Take One of the Parties Offline • Once you’ve guessed the correct sequence number, time to eliminate the sender so you can take over the session. • Generally done with some form of Denial of Service attack. • Server still responds to original system but it never knows because it has been taken out.

  28. Take Over the Session • Now the attacker has everything set up • Session • Sequence number • Sender (usually client) taken out • Now exploit session, ideally something like a telnet session where you can issue commands such as creating a new account or adding system to list of trusted systems.

  29. Hijacking, doesn’t sound so simple… • In theory, it is very complex, fortunately there are some programs out there that can help you. • Juggernaut • Hunt • TTY Watcher • IP Watcher • All of these are of the “sniffer” type, must see traffic to be able to hijack it. • Think about what is needed to hijack a session you can’t see. • Remember, however, that I don’t need to be able to sniff all traffic to a server, I can be sniffing at the client side.

  30. Protecting Against Session Hijacking • Use encryption • Use a secure protocol (usually includes encryption) • Limit incoming connections • Minimize remote access (referring to outgoing) • Have strong authentication (though this is less effective in protecting against hijacking since you are taking over a session after authentication has taken place.)

  31. Summary • Hijacking is a real threat • Technology is straightforward • Many tools available to do this • There are legal ramifications

More Related