Network security is a problem that now affects everyone, not just businesses and banks and comes at a time when you have multiple computers connected together, now that e-commerce, online transactions between companies and global connectivity are now essential components of a good marketing strategy, more and more companies are adopting new processes and practices to protect their computing resources. Many companies are actively committed to a policy of efficient and effective security by implementing the latest products and services to prevent fraud, vandalism and attacks denial of service (DoS) (Denial of Service). However, companies often overlook the element that contributes most to make good security policies: they do not control the network and security systems to ensure that they work as expected. The networks have different vulnerabilities to exploit, more or less easily, by a third party to meddle in the system and intercept data. An important aggravating factor stems from the fact that the Internet was created as a network teaching in a university environment e le sue regole non prevedono metodi di sicurezza impliciti alla propria struttura: le difese devono essere messe in atto sulle macchine stesse o creando strutture di rete particolari. I principali punti deboli, ed i relativi attacchi, che minano alla sicurezza delle reti sono:
Numero di sequenza [modifica]
L'attacco al numero di sequenza viene utilizzato per avere accesso al sistema ed intercettare informazioni importanti, quali login, password e dati riservati, che il sistema stesso trasmette al server. Poiché, durante una comunicazione tra computer attraverso una rete TCP, ad ogni pacchetto viene allegato un indirizzo IP ed un numero di sequenza (ossia un numero univoco), l'hacker dovrà in primo luogo mettersi in ascolto Internet packages and determine the IP address of the server, and only then will be able to control the sequence numbers of the package. This monitoring is designed to allow to predict what the next sequence number generated and thus to insinuate itself between the user and the server by sending its own packet marked with that number. The hacker, at this point, is able to intercept transmissions by the user because, knowing the IP address of the server, it can generate packets with numbers senquenza and correct IP addresses. This type of violation is often done in view of a further attack on another server on the network.
IP Spoofing [edit]
L'IP Spoofing consiste nell'introdursi in un sistema informativo, del quale non si ha l'autorizzazione, cambiando il proprio IP non valido in uno valido. Con questo sistema si fa credere alla vittima che si è qualcosa di diverso (un hostname, un indirizzo ethernet, ecc). L'attacco a spoofing può essere considerato come una variante dell'attacco a Sniffer attivo e viene condotto generalmente sulla posta elettronica.
Attacchi a Sniffer [modifica]
Serve per impossessarsi di password e user-id di un utente autorizzato per accedere alla rete locale. Possedendo tali dati, l'hacker può entrare nella rete, copiare i pacchietti dati dagli utenti ed accaparrarsi le informazioni che gli interessano. Lo sniffer può essere active or passive. A protection against this type of vulnerability can be provided by firewalls and encryption on the information exchanged.
desynchronization initial attachment [edit]
consist of breaking, by the hacker, the connection server, enabling it to create a new connection is marked by a different sequence number.
Telnet session [edit]
also telnet sessions can be intercepted by a hacker: he, after observing passively broadcasting network, will create an interruption of the telnet session by sending in massive amounts of invalid data (to be however, deleted from the telnet daemon server), causing a desynchronization of the session. Using the same procedure, the attacker will also desynchronization in the client, and will listen on the sequence numbers of packets to maintain the connection and control the session. If, however, this session will not accept the transmission of null data, the attack can not take place.
Hijacking TCP (or hijack TCP) [edit]
For servers connected to the internet, the hijacking of TCP is the most serious threat, because it allows the attacker to enter into an operating system other than their own. With this procedure, in fact, you can circumvent host also equipped with high levels of security, proprio perché permette di aggirare i sistemi di password monouso. Contrariamente all'attacco al numero di sequenza, qui l'hacker ottiene l'accesso costringendo la rete ad accogliere come fidato il proprio indirizzo IP.
Altri tipi di minacce alla sicurezza delle reti sono le backdoor, che permettono all’hacker di entrare nuovamente e facilmente in un sistema che ha già violato, e i worm, che possono essere considerati i virus dei sistemi Unix.
Molti problemi della sicurezza delle reti sono legati alla gestione dell'ARP(Address Resolution Protocol), ARP è un protocollo di servizio, utilizzato in una rete di calcolatori che utilizzi il protocollo di rete IP sopra una rete di livello datalink che supporti il servizio di broadcast. Se questo servizio non è disponibile, come ad esempio in ATM, devono essere utilizzati altri meccanismi.
Per inviare un pacchetto IP ad un calcolatore della stessa sottorete, è necessario incapsularlo in un pacchetto di livello datalink, che dovrà avere come indirizzo destinazione il mac address del calcolatore a cui lo si vuole inviare. ARP viene utilizzato per ottenere questo indirizzo.
Se il pacchetto deve essere inviato ad un calcolatore di un'altra sottorete, ARP viene utilizzato per scoprire il mac address del gateway.
In ogni calcolatore, il protocollo ARP tiene traccia delle risposte ottenute in una apposita cache, per evitare di utilizzare ARP prima di inviare ciascun pacchetto. Le voci della cache ARP vengono cancellate dopo a certain period of time. Now the question arises ARP does not provide mechanisms to authenticate the responses received, then the host sends a request to "trust" that the answer comes from the "legitimate" owner requested IP address, and identifies with that IP address the mac address that you have. This creates conditions for a number of vulnerabilities as already mentioned above LIP Spoofing ARP Spoofing and construction of art to a malicious ARP is simple on both Linux and Windows, and in fact this is one of the greatest vulnerability of local networks. In fact, by sending an ARP reply to host a counterfeit we can appropriately modify its ARP cache, such as the ability to obtain to intercept data intended for other hosts. This technique is called ARP spoofing and ARP cache poisoning (in English, ARP cache poisoning).
The vulnerability of the networks but can not be totally eliminated can be reduced by a good firewall, keeping your system updated and especially paying attention to what you get. Around the net there are some very good freeware tool to defend themselves:
Nmap Nmap (Network Mapper), an open source tool for network exploration and security auditing, which is used by many administrators who want to map and test their networks for vulnerabilities. Nmap offers a wide range of techniques for port scanning destinate alla scansione veloce di grandi e piccole reti. Nmap è inoltre conosciuto per la sua capacità ineguagliata di individuare non solo il sistema operativo di una macchina e i servizi che offre, ma anche i filtri di pacchetto e i firewall in uso sulla rete.
Eseguendo Nmap, scoprite quali porte sono visibili su una macchina e i servizi che vi stanno girando sopra, potendo così inventariare o identificare i punti deboli della rete. Le caratteristiche di mapping di Nmap vi consentono inoltre di verificare se sono avvenuti cambiamenti dall'ultima scansione. Per esempio, potete vedere se una macchina infettata da un worm sta provando ad aprire le porte per “ascoltare” le istruzioni dal suo controller.
Mentre Nmap può dirvi quali machines and services are available on a network, the quickest way to identify services that can be exploited is to use a security scanner. Which brings us to Nessus, the second of our freeware tools list.
Nessus
Started in 1998, the Nessus project aimed to provide a device for the free remote security scanner that was powerful, updated and easy to use. Today, Nessus is one of the most popular security scanner and is recommended by several organizations, information security, including the SANS Institute. Nessus has often been the first to introduce innovative features, such as the ability to not only detect faults remotely, but also local and pacth missing host on the network, regardless of whether you are working with Windows, Mac OS X or Unix. Incidentally, Nessus invokes Nmap at the beginning of each scan.
Among other key features of Nessus are testing multiple services: in other words, if the host is running multiple times the same service, the program will test a similar number of times. In addition, its clever way of recognition allows dentificare services running on nonstandard ports. Nessus can also test SSL services such as HTTP and SMTP. And, while many security scanners only perform non-destructive testing of security audits, Nessus can show how a host would act in case of a attack by those who attempt to gain unauthorized access.
databases for the Nessus security control are updated daily, with each written test as external plugin, or simply as a safety program that checks whether a specific problem. The plugins are written in Nessus Attack Scripting Language and execute in this environment on a virtual machine, this makes Nessus an extremely secure scanner. Currently, there are over 10,000 different plugins used by Nessus and an RSS feed of all the latest security checks allows you to monitor which plugins are added and when. Nessus has been intensively tested and verified for a long time on the networks of all sizes.
OpenSSH
The last tool we are talking about is OpenSSH. We believe that the best way to allow applications to authenticate to other resources and using Secure Shell (SSH). As long as the link between the services uses TCP, such services can use the SSH channel to authenticate each other and increase security against different types of attacks.
For example, SSH can encrypt passwords and network traffic between the Web and database servers, preventing a possible interception, the tricks to fool the IP and DNS, IP source routing, and other attacks in the network. OpenSSH is a good implementation, free and open source SSH, which supports standard protocols SSH 1.3, 1.5 and 2.0.
With OpenSSH, encryption starts before authentication and no password or other information is sent in clear text, thus eliminating the danger of interception, dell'hijacking connections and other attacks. Encryption is also used to protect packages from "fake".
Additionally, OpenSSH provides secure tunneling capabilities and several authentication methods, such as public keys, passwords to be used once and Kerberos authentication.
0 comments:
Post a Comment