Transcript home network security emphasis on web spoofing

HOME NETWORK SECURITY –
EMPHASIS ON WEB SPOOFING
CS 265
SHALINI RAMESH
TOPICS
•Crisis
•Computer Crimes
•Types of Spoofing
•Web Spoofing
-
working
- short term solutions
- long term solutions
•General Precautions
Crisis
•
•
•
•
•
Internet has grown very fast and security has
lagged behind.
Legions of hackers have emerged as impedance to
entering the hackers club is low.
It is hard to trace the perpetrator of cyber attacks
since the real identities are camouflaged.
It is very hard to track down people because of the
ubiquity of the network.
Large scale failures of internet can have a
catastrophic impact on the economy which relies
heavily on electronic transactions.
Why Security?
• Some of the sites which have been compromised
–
–
–
–
–
–
–
U.S. Department of Commerce
NASA
CIA
Greenpeace
Motorola
UNICEF
Church of Christ …
• Some sites which have been rendered ineffective
–
–
–
Yahoo
Microsoft
Amazon …
Growing Networks
Wired & Wireless Networks
Protocol- is a well defined specification that allows
computers to communicate across a network.
Internet Protocol – can be thought of as a common
language of computers on the internet.
IP address – every computer on the internet has an IP
address associated with it. But this address may change
over time due toDialing into ISP
Connected behind a network firewall
Connected to a broadband service using dynamic IP
addressing.
TECHNOLOGY
Dial-up
Broadband
Connection type
Dial on demand
Always on
IP address
Changes on each
call
Static or
infrequently
changing
Relative
connection speed
Low
High
Remote control
potential
Computer must be
dialed in to control
remotely
Computer is always
connected, so
remote control can
occur anytime
ISP-provided
security
Little or none
Little or none
What can intruders do?
•Attackers can gain control of the system and launch
attacks on other systems.
•They can hide their true location and attack high profile
computer system in government or financial institutions.
•Intruders can program in such a way, where they can
watch all the actions a person does.
•Reformat the hard disc and change the data of a good
guy.
Intentional misuse of your computer
1. Trojan horse programs
2. Back door and remote administration programs
3. Denial of service
4. Being an intermediary for another attack
5. Unprotected Windows shares
6. Mobile code (Java, JavaScript, and ActiveX)
7. Cross-site scripting
8. Email spoofing
9. Email-borne viruses
10. Hidden file extensions
11. Chat clients
12. Packet sniffing
Trojan horse programs:
•Intruder tricks the computer user into installing “back
door” programs.
•Intruder gets easy access to the system without the user’s
knowledge.
•Intruder can change the system configuration
•He can infect the computer with virus.
Back door and remote administration programs:
•Mostly windows computers are vulnerable to this attack.
•3 tools which are commonly used by intruders to gain
control are BACKORIFICE, NETBUS and SUBSEVEN.
Denial of service
•This attack causes the user’s computer to crash or it
becomes very busy processing data, that the owner of
the computer becomes unable to use it.
Unprotected windows shares
•Unprotected windows networking shares can be
exploited by the intruders in an automated way to place
tools on a large number of windows-leased computers
attached to the internet.
•Site security on the internet is inter- dependent.
•Another threat is that worms and virus propagate thro’
unprotected windows networks.
Eg: 911 worm
Mobile code ( java / java script /activex )
•These programming languages let web developers to write
code and they are executed on the browser.
•This code can be used by intruders to gather information
about various things, the user does on the internet.
Email borne viruses
Viruses and other types of malicious code mostly spread
thro’ attachments with email messages.
The user should never run a program which he has
received from an unauthorized address.
Cross-site scripting
A bad guy may attach a script to something and send it to
a website. Later when the web-site responds to the user,
the malicious script is transferred to the user’s browser.
The many ways this can happen is•Following links in web pages, email messages without
knowing what the link is.
•Using interactive forms on an untrustworthy website
•Participating in online discussion groups, where users can
post text containing HTML tags only.
Spoofing
Definition:
An attacker alters his identity so that some one thinks he
is some one else
– Email, User ID, IP Address, …
– Attacker exploits trust relation between user and
networked machines to gain access to machines
Types of Spoofing:
1.
2.
3.
4.
IP Spoofing:
Email Spoofing
Web Spoofing
Frame Spoofing
Email Spoofing
pretending to be somebody else in emails.
IP Spoofing
pretending to be somebody else’s machine( pretending to
be the trusted intranet host with a particular IP address )
Frame Spoofing
attacker inserts a frame into the web-page.
one of the user frames can be controlled by an attacker
while the others are normal.
DETAILS ABOUT WEB – SPOOFING
web – spoofing
pretending to be somebody else’s website.
• It is an internet security attack that could endanger the
privacy of world wide web users and the integrity of their
data.
•Today’s browsers like internet –explorer and Netscape
navigator are vulnerable to this attack.
•Almost unnoticeable to web page visitor
•Changes are so small and buried in thousands of lines of
html source code.
•www.ebay.com becomes www.ebey.com
WWW SERVER
VICTIM
Classic example of
Man-in–the-middle
1
5
Rewritten
page sent
Request
URL
3
Rewrite page
4
Send
requested
URL
ATTACKER
2
Request
URL
Working
1. Attacker registers a web address matching an entity.
2. Eg; amazone.com , ebey.com
3. Web- spoofing allows the attacker to create a “shadow
copy” of the entire world wide web.
4. The user accesses this shadow web thro’ the attacker’s
machine.
5. The attacker gets hold of all the personal information
like user-ids, passwords, financial statements.
6. Another major drawback is that the attacker can send
false or misleading data to the web servers in the user’s
name or vice-versa.
7. In other words the attacker controls all the activities a
user does on the web.
How the attack works?
•The attacker creates misleading context in order to
trick the victim into making an inappropriate security
relevant decision.
•The attacker sets up a false but convincing world
around the victim.
•The victim thinks that the false world is the real world
and does something which will have disastrous effects.
•After the attacker makes a copy of the page
requested, looks for all special html commands that
may reference a URL and changes them.
Details
URL rewriting:
The attacker’s first trick is to rewrite all the Url’s on
some web-page so that they point to the attacker’s server
rather than the real server.
Consider http://www.hotmail.com
Is rewritten as
http://www.attacker.org/http://hotmail.com
Where www.attacker.org is the attacker’s server.
Once the attacker’s server gets the real document, he
rewrites all the url’s .
Then the attacker’s server sends the rewritten page to
the victim.
The real attack
1. To start an attack, the attacker must convince the
victim to use the attacker’s false web.
2. He can put a link of his web on a popular website.
3. The attacker can email the victim a pointer to the
false web
4. Attacker can trick a web search engine into
indexing part of the false web.
Perfecting the art:
• Some content that give the victim clues that an
attack is being made.
• Easy to convince the victim, because browsers are
very customizable.
Perfecting the art
STATUS LINE:
A single line of text at the bottom of the browser. When
the mouse is held on the web page, the url is displayed.
The victim might notice a false URL.
When the page is being fetched the status line briefly
displays the name of the server being contacted.
Hence www.attacker.org may be displayed.
Solution :
The attacker can cover up both by adding a java script
program to every rewritten page.
These programs can write to status line
Hence they always show the victim the address of the
real web
LOCATION LINE
Displays the url of the current page.
Rewritten url may appear on the location line
Solution :
a java script program can hide the real location line
and replace it by a false location line that looks right
and is in the same expected place.
This fake location line can also accept keyboard input,
allowing the victim to type in the url’s normally.
Viewing document source :
A user can possibly see the rewritten urls in the HTML
source code and could spot an attack.
Solution:
Write a JavaScript to hide a browser’s menu bar,
replacing it with a menu bar that looks identical.
From this the user could view the original (nonrewritten) HTML source.
Tracing an attacker:
Not possible!!!!!!!!!!!!!!!!!
He attacks thro’ some innocent user’s machine.
Smart hacker
1.) Victim uses IE, hacker might write an ActiveX
control, which is executed each time the victim runs the
browser.
The hacker’s ActiveX might replace a normal URL with
hacked URL.
2.) hacker can hide the rewritten URL using an embedded
program within the spoofing server
This hides the real location line and replaces it with a
fake location line.
Secure connection
•Attack works even when victim requests a page
thro’ secure connection
•Secure web access using S-HTTP or Secure
Sockets Layer – browser display is as usual
•Hacker’s server will deliver the page
•Victim’s browser will turn on the secure
connection indicator
•But!!!!!!!!!!!!!!!!!!!!!!!!
Example?????????
False ATM machine in public areas.
Misleading URLs...
Neither of the following two links are really CNN...
http://www.cnn.com:mainpage@2175456613/~sws/0/ (works from most
platforms)
http://www.cnn.com:[email protected]/~sws/0/ (works from
most of the
Spoofing can be of 2 types
1] Security-relevant decisions:
the decision taken by the user may result in
breach of privacy or unauthorized tampering with data.
Eg:
Typing in a password or user-id
The user accepts a downloaded document, which
contains malicious elements that may harm the user.
2] context
The text and pictures on a web page might give
some information as to where the page came from
Eg:
If the user sees a corporate logo, then he can assume
that the page originated from that company.
WWW.MICROSOFT.COM
WWW.MICR0S0FT.COM
Manual.doc may not be so !!!!!!!!!!!!!
Ways to attack :
The attacker can see and modify any data that is going
from the victim to the web server. The attacker may also
control the return traffic from the web server to the
victim.
1] Surveillance
•The attacker passively watches the traffic moving along
the network.
•He will be able to record the pages the victim visits and
the contents of those pages
•In an interactive form , the details are captured.
2] Tampering:
•The attacker modifies the data from the victim to the
server
•He can also modify the data from the server to the victim
Spoofing the www:
The attacker does not have the whole spoofed copy. Only
the web page requested is spoofed.
Short term solution :
•Disable JavaScript in the browser – attacker unable to
hide the evidence
•Browser’s location line is always visible
•Keep checking the urls – are they the intended ones.
•Disable java, ActiveX
•Use URL checking software to check that the links point
to expected locations.
•Use host security policies & procedures to ensure that
critical files cannot be modified. Eg: Some type of access
control method to deny access if somebody attempts to
modify files.
Contd………………….
•Enabling the browser to show the URL we are
accessing. This enables us to see the actual URL that
is being referenced.
•Do not be paranoid- old saying “ just because you are
paranoid does not mean that somebody isn’t trying to
get you”
Long term solutions :
•Action on the part of browser manufacturers-Changing
browser code so that the browser always displays the
location line
•An improved secure connection indicator would help,
for pages fetched via secure locations.
•Indicate the browser at the other end
•Use simple language to indicate like HP.Inc instead of
www.hp.com
Arcticsoft’s solution :
Arcticsoft’s WebAssurity
•Lets users dynamically verify web pages
•User can instantly say if anything is wrong
Some general precautions:
•Consult your system support personnel if you work from
home
•Use virus protection software
•Don't open unknown email attachments
•Don't run programs of unknown origin
•Keep all applications, including your operating system,
patched
•Turn off your computer or disconnect from the network when
not in use
•Make a boot disk in case your computer is damaged or
compromised
•Make regular backups of critical data
References :
Website of department of Computer Science,
Princeton University - www.cs.princeton.edu
Website of Carnegie Mellon University
www.cs.dartmouth.edu
www.systemexperts.com
citeseer.nj.nec.com