s07-流量内容监控-attack

,单击此处编辑母版文本样式,第二级,第三级,第四级,第五级,*,网络攻击的检测和预防,第七章,目录,常见网络攻击的检测和预防,DoS,攻击的防范,黑客攻击网络的一般过程,信息的收集,利用的公开协议或工具,TraceRoute,程序,SNMP,协议,DNS,服务器,Whois,协议,Ping,实用程序,黑客攻击网络的一般过程,系统安全弱点的探测,主要探测的方式,自编程序,慢速扫描,体系结构探测,利用公开的工具软件,黑客攻击网络的一般过程,建立模拟环境，进行模拟攻击,根据前面两小点所得的信息,建立一个类似攻击对象的模拟环境,对此模拟目标进行一系列的攻击,黑客攻击网络的一般过程,具体实施网络攻击,根据前几步所获得的信息,结合自身的水平及经验总结相应的攻击方法,等待时机，以备实施真正的网络攻击,协议欺骗攻击及防范,源,IP,地址欺骗攻击,在路由器上的解决方法,防止源,IP,地址欺骗行为的措施,抛弃基于地址的信任策略,使用加密方法,进行包过滤,协议欺骗攻击及防范,源路由欺骗攻击,防范源路由欺骗攻击的措施,抛弃由外部网进来却声称是内部主机的报文,在路由器上关闭源路由,协议欺骗攻击及防范,拒绝服务攻击,防止拒绝服务攻击的措施,调整该网段路由器上的配置,强制系统对超时的,Syn,请求连接数据包复位,缩短超时常数和加长等候队列,在路由器的前端做必要的,TCP,拦截,关掉可能产生无限序列的服务,拒绝服务攻击,用超出被攻击目标处理能力的海量数据包消耗可用系统，带宽资源，致使网络服务瘫痪的一种攻击手段,两种使用较频繁的攻击形式,TCP-SYN flood,半开式连接攻击,UDP flood,拒绝服务攻击,拒绝服务攻击,UDP flood,Udp,在网络中的应用,如，,DNS,解析、,realaudio,实时音乐、网络管理、联网游戏等,基于,udp,的攻击种类,如，,unix,操作系统的,echo,chargen,. echo,服务,拒绝服务攻击,Trinoo,是基于,UDP flood,的攻击软件,Trinoo,攻击功能的实现,是通过三个模块付诸实施的,攻击守护进程,NS,攻击控制进程,MASTER,客户端,NETCAT,，,标准,TELNET,程序等,拒绝服务攻击及防范,六个,trinoo,可用命令,Mtimer,Dos,Mdie,Mping,Mdos,msize,拒绝服务攻击,拒绝服务攻击,攻击的实例,:,被攻击的目标主机,victim IP,为,:12.23.34.45 ns,被植入三台,sun,的主机里，他们的,IP,对应关系分别为,client1:11.11.11.11 client2:22.22.22.22 client3:33.33.33.33 master,所在主机为,masterhost:11.22.33.44,首先我们要启动各个进程，在,client1,，,2,，,3,上分别执行,ns,，,启动攻击守护进程， 其次，在,master,所在主机启动,master,masterhost,# ./master ?,gOrave,(,系统示输入密码，输入,gOrave,后,master,成功启动,),trinoo,v1.07d2+f3+c Mar 20 2000:14:38:49 (,连接成功,),拒绝服务攻击,在任意一台与网络连通的可使用,telnet,的设备上，执行,telnet 11.22.33.44 27665,Escape character is .,betaalmostdone,(,输入密码,),trinoo,v1.07d2+f3+c.rpm8d/cb4Sx/,trinoo, (,进入提示符,),trinoo,mping,(,我们首先来监测一下各个攻击守护进程是否成功启动,),mping,: Sending a PING to every,Bcasts,.,trinoo, PONG 1 Received from 11.11.11.11,PONG 2 Received from 22.22.22.22,PONG 3 Received from 33.33.33.33 (,成功响应,),trinoo,mtimer,60 (,设定攻击时间为,60,秒,),mtimer,: Setting timer on,bcast,to 60.,trinoo, dos 12.23.34.45,DoS,:,Packeting,12.23.34.45.,拒绝服务攻击,至此一次攻击结束，此时,ping 12.23.34.45,，,会得到,icmp,不可到达反馈，目标主机此时与网络的正常连接已被破坏,拒绝服务攻击,由于目前版本的,trinoo,尚未采用,IP,地址欺骗，因此在被攻击的主机系统日志里我们可以看到如下纪录,Mar 20 14:40:34 victim,snmpXdmid,: Will attempt to re-establish connection.,Mar 20 14:40:35 victim,snmpdx,: error while receiving a,pdu,from 11.11.11.11.59841: The message has a wrong header type (0x0),Mar 20 14:40:35 victim,snmpdx,: error while receiving a,pdu,from 22.22.22.22.43661: The message has a wrong header type (0x0),Mar 20 14:40:36 victim,snmpdx,: error while receiving a,pdu,from 33.33.33.33.40183: The message has a wrong header type (0x0),Mar 20 14:40:36 victim,snmpXdmid,: Error receiving PDU The message has a wrong header type (0x0).,Mar 20 14:40:36 victim,snmpXdmid,: Error receiving packet from agent;,rc,= -1.,Mar 20 14:40:36 victim,snmpXdmid,: Will attempt to re-establish connection.,Mar 20 14:40:36 victim,snmpXdmid,: Error receiving PDU The message has a wrong header type (0x0).,Mar 20 14:40:36 victim,snmpXdmid,: Error receiving packet from agent;,rc,= -1.,拒绝服务攻击防范,检测系统是否被植入了攻击守护程序,办法,检测上述提到的,udp,端口,如,netstat,-a |,grep,udp,端口号,用专门的检测软件,拒绝服务攻击及防范,下面为在一台可疑设备运行结果，,Logging output to: LOG,Scanning running processes.,/proc/795/object/a.out:,trinoo,daemon,/,usr/bin/gcore,: core.795 dumped,/proc/800/object/a.out:,trinoo,master,/,usr/bin/gcore,: core.800 dumped,Scanning /,tmp,.,Scanning /.,/yiming/tfn2k/td: tfn2k daemon,/yiming/tfn2k/tfn: tfn2k client,/,yiming/trinoo/daemon/ns,:,trinoo,daemon,/,yiming/trinoo/master/master,:,trinoo,master,/,yiming/trinoo/master,/.: possible IP list file,NOTE: This message is based on the filename being suspicious, and is not,based on an analysis of the file contents. It is up to you to examine the,file and decide whether it is actually an IP list file related to a DDOS,tool.,/yiming/stacheldrahtV4/leaf/td:,stacheldraht,daemon,/yiming/stacheldrahtV4/telnetc/client:,stacheldraht,client,/yiming/stacheldrahtV4/td:,stacheldraht,daemon,/yiming/stacheldrahtV4/client:,stacheldraht,client,/yiming/stacheldrahtV4/mserv:,stacheldraht,master,ALERT: One or more DDOS tools were found on your system.,Please examine LOG and take appropriate action.,拒绝服务攻击防范,封掉不必要的,UDP,服务,如,echo,chargen,减少,udp,攻击的入口,拒绝服务攻击防范,路由器阻挡一部分,ip,spoof,syn,攻击,通过连接骨干网络的端口,采用,CEF,和,ip,verify,unicast,reverse-path,使用,access control lists,将可能被使用的网络保留地址封掉,使用,CAR,技术,限制,ICMP,报文大小,Specific Attack Types,All of the following can be used to compromise your system:,Packet sniffers,IP weaknesses,Password attacks,DoS or DDoS,Man-in-the-middle attacks,Application layer attacks,Trust exploitation,Port redirection,Virus and,worms,Trojan horse,Operator error,IP Spoofing,IP spoofing occurs when a hacker inside or outside a network impersonates the conversations of a trusted computer.,Two general techniques are used during IP spoofing:,A hacker uses an IP address that is within the range of trusted IP addresses.,A hacker uses an authorized external IP address that is trusted.,Uses for IP spoofing include the following:,IP spoofing is usually limited to the injection of malicious data or commands into an existing stream of data.,A hacker changes the routing tables to point to the spoofed IP address, then the hacker can receive all the network packets that are addressed to the spoofed address and reply just as any trusted user can.,IP Spoofing Mitigation,The threat of IP spoofing can be reduced, but not eliminated, through the following measures:,Access controlThe most common method for preventing IP spoofing is to properly configure access control.,RFC 2827 filteringYou can prevent users of your network from spoofing other networks (and be a good Internet citizen at the same time) by preventing any outbound traffic on your network that does not have a source address in your organizations own IP range.,Additional authentication that does not use IP-based authenticationExamples of this include the following:,Cryptographic (recommended),Strong, two-factor, one-time passwords,Application Layer Attacks,Application layer attacks have the following characteristics:,Exploit well known weaknesses, such as protocols, that are intrinsic to an application or system (for example, sendmail, HTTP, and FTP),Often use ports that are allowed through a firewall (for example, TCP port 80 used in an attack against a web server behind a firewall),Can never be completely eliminated, because new vulnerabilities are always being discovered,Application,LayerAttacksMitigation,Some measures you can take to reduce your risks are as follows:,Read operating system and network log files, or have them analyzed by log analysis applications.,Subscribe to mailing lists that publicize vulnerabilities.,Keep your operating system and applications current with the latest patches.,IDSs can scan for known attacks, monitor and log attacks, and in some cases, prevent attacks.,Network Reconnaissance,Network reconnaissance refers to the overall act of learning information about a target network by using publicly available information and applications.,Network Reconnaissance Mitigation,Network reconnaissance cannot be prevented entirely.,IDSs at the network and host levels can usually notify an administrator when a reconnaissance gathering attack (for example, ping sweeps and port scans) is under way.,Virus and Trojan Horses,Viruses refer to malicious software that are attached to another program to execute a particular unwanted function on a users workstation. End-user workstations are the primary targets.,A Trojan horse is different only in that the entire application was written to look like something else, when in fact it is an attack tool. A Trojan horse is mitigated by antivirus software at the user level and possibly the network level.,DOS/DDOS,DOS,拒绝服务攻击,DDOS,分布式拒绝服务攻击,利用,TCP/IP,缺陷,常见,DOS,工具,Bonk,通过发送大量伪造的,UDP,数据包导致系统重启动,TearDrop,通过发送重叠的,IP,碎片导致系统的,TCP/IP,栈崩溃,SynFlood,通过发送大量伪造源,IP,的基于,SYN,的,TCP,请求导致系统重启动,Bloop,通过发送大量的,ICMP,数据包导致系统变慢甚至凝固,Jolt,通过大量伪造的,ICMP,和,UDP,导致系统变的非常慢甚至重新启动,SynFlood,原理,Syn,伪造源地址(1.1.1.1),IP:211.100.23.1,1.1.1.1(,TCP,连接无法建立，造成,TCP,等待超时）,Ack,大量的伪造数据包发向服务器端,DDOS,攻击,黑客控制了多台服务器，然后每一台服务器都集中向一台服务器进行,DOS,攻击,DDOS,攻击示意图,分布式拒绝服务攻击,分布式拒绝服务攻击步骤1,Scanning,Program,不安全的计算机,Hacker,攻击者使用扫描工具探测扫描大量主机以寻找潜在入侵目标。,1,Internet,分布式拒绝服务攻击步骤2,Hacker,被控制的计算机(代理端),黑客设法入侵有安全漏洞的主机并获取控制权。这些主机将被用于放置后门、,sniffer,或守护程序甚至是客户程序。,2,Internet,分布式拒绝服务攻击步骤3,Hacker,黑客,在得到入侵计算机清单后，从中选出满足建立网络所需要的主机，放置已编译好的守护程序，并对被,控制的计算机发送命令。,3,被控制计算机（代理端）,Master,Server,Internet,Hacker,Using Client program,黑客发送控制命令给主机，准备启动对目标系统的攻击,4,被控制计算机（代理端）,Targeted,System,Master,Server,Internet,分布式拒绝服务攻击步骤4,Targeted,System,Hacker,主机发送攻击信号给被控制计算机开始对目标系统发起攻击,。,5,Master,Server,Internet,被控制计算机（代理端）,分布式拒绝服务攻击步骤5,分布式拒绝服务攻击步骤6,Targeted,System,Hacker,目标系统被无数的伪造的请求所淹没，从而无法对合法用户进行响应，,DDOS,攻击成功。,6,Master,Server,User,Request Denied,Internet,被控制计算机（代理端）,分布式拒绝服务攻击的效果,整个过程是自动化的,攻击者能够在5秒钟内入侵一台主机并安装攻击工具,也就是说，在短短的一小时内可以入侵数千台主机,并使某一台主机可能要遭受1000,MB/S,数据量的猛烈攻击,这一数据量相当于1.04亿人同时拨打某公司的一部电话号码,BGP,网络,DDOS,攻击的解决案例,实验演示。,（一定程度保密协议的案例）,