Spoofing

Spoofing is the act of using one machine to impersonate another. An intruder can launch attacks using the identity of another machine so that the intruder would not be held liable for his actions. For instance, an intruder can mask the identity of a machine with special access privileges to obtain control of other computers on the network. Then the intruder can launch a denial of service attack (will be discussed later in 6.1.4 Denial of Service) on a target computer system by sending numerous data packets to tie up the target system's network resources, and cause the system to become unavailable to other users. When the targeted system tries to find the attacker, the trace results would likely to point to the machine that was used to mask the identity of the intruder.

Two methods of spoofing are IP spoofing and email spoofing.

IP spoofing is a technique used to gain unauthorized access to computers, whereby the intruder sends messages to a computer with an IP address indicating that the message is coming from a trusted host. To use IP spoofing, an intruder must first identify an IP address of a trusted host and then modify the packet headers so that the packets look like they are coming from that host. This method is effective because dialog between machines are automated, which eliminates the need for username or password.

For more information on the many forms of IP spoofing, read "Spoofing: An Overview of Some of the Current Spoofing Threats" from the SANS website. The SANS website also contains a paper on "Introduction to IP spoofing".

Another technique is email spoofing where an attacker fakes an email header to make it appear as if it came from somewhere or someone other than the actual source.

The following are examples of spoofed emails that could lead to an attack on data integrity:

• Email from a system administrator instructing users to delete files, or provide sensitive information such as logins and passwords

• Email claiming to be from a system administrator requesting users to change their passwords to a specified string and threatening to suspend their account if they do not comply

• Email claiming to be from a person in authority requesting users to send them a copy of a password file or other sensitive information

Note that Internet service providers usually will not specify your new password. Also, most legitimate service providers would never ask you to send them any password information via email, phone, or any other means.

You can read about a real-world e-mail spoofing on Best Buy, "E-mail Scam Makes Best Buy Scramble."

Prevention:

• Monitor transaction logs of servers such as email server, Web server, and scan for unusual behaviors (monitoring should be done off-line to avoid attacks during the process)

• Minimize system privileges of servers

• Limit user access to network or administrator command functions

Port Scanning

The objective of port scanning is to detect security weaknesses in a remote or local host. A port scanner is a program that scans TCP/IP ports and services (for example, TELNET or FTP) and reports responses from the target system. An intruder can use a port scanner to find information about the target host such as which port is open and whether an anonymous user can log in. Once an intruder logs in successfully through the open port, the intruder can try to gain access to more computers on the network. Port scanning activity is usually a precursor to an attack on a target system.

Prevention:

• Close unused ports

• Monitor suspicious network activities (for example, if a host is scanning through port activities, the attacker may be preparing for an attack)