IP Insecurity
Computerworld - Stolen credit card numbers, hacked federal computer systems and other high-profile online assaults have put many users on their guards and focused the attention of security managers on high-level intrusion-detection systems, chains of firewalls and other high-level defenses. But many forget that, no matter how hard they try to secure a site, vulnerabilities built into the fabric of the Internet still leave them at risk - even though measures to shut down the most glaringly common vulnerabilities are easily available.
Simple functions like the ability to request a connection between two machines can create openings that are to blame in about 15% of the attacks that are reported each year, says Fred Baker, chairman of the Internet Engineering Task Force. That's because TCP/IP hasn't changed much since the days of its acceptance as the Arpanet transport protocol.
"[Internet Protocol] was originally written among a cohesive community that had significant internal trust. By default, IP applications assume they should trust people," Baker says.
Denial-of-service and data hijacking attacks using functions of TCP/IP can be prevented using security functions that can be turned on in most server operating systems, filters built into routers or a new version of IP (Version 6), which is a standard for the public-key infrastructure IPSec protocol.
But those security measures are often ignored.
Take the TCP attack that was "rediscovered" in March by security services firm Guardent Inc. in Waltham, Mass. Guardent researchers figured out a new way to exploit an old problem with TCP: the ability of a hacker to hijack a session if he can guess the random initial sequence number (ISN) that two machines use to start a sequence of packets.
Once an attacker guesses the ISN, he can redirect the packets or inject anything into the data stream. Software vendors were thought to have averted this problem with random packet sequence generators. Turns out those random sequences aren't so random after all and actually contain patterns that make the ISN easy to guess, says Jerry Brady, vice president of research and development at Guardent.
Another ancient exploit, spoofing IP addresses, is also common today, says Paul Raines, head of global information risk management at Barclays Capital, an investment bank in New York.
"Classic TCP/IP attacks such as IP spoofing and denial-of-service attacks using buffer overflows are still out there," he says. "Take the [distributed denial-of-service] attack executed by Mafia Boy last year. He planted Trojan horses in unsuspecting servers. Those servers then flooded e-commerce sites with a load of service requests that contained



- Excel 2010 Cheat Sheet
- Register for this Computerworld Insider Cheat Sheet and gain access to hundreds of premium content articles, guides, product reviews and more.
- Digital Transformation: Creating New Business Models Where Digital Meets Physical
- Individuals and businesses alike are embracing the digital revolution. Social networks and digital devices are being used to engage government, businesses and civil...
- Make the Connection: Better Network Connectivity Drives Transformation
- Network connectivity is more than just plumbing. Leading organizations today see high-performance network connectivity as a critical enabler of competitive advantage, and not...
- Virtualizing Government Infrastructure
- All server virtualization solutions are not created equal. The more-with-less agenda for government agencies is tailor-made for server virtualization, which is evolving into...
- Moving Service Management to SaaS
- Today, organizations can enjoy similarly substantial benefi ts by migrating their IT service management functions to a software-as-a-service model. This paper shows how...
- Achieving 360 Degree Network Visibility with Nimsoft
- 360° network visibility is critical for ensuring continuous availability of networks, servers, and applications-anything less could
have costly bottom-line implications.
All Networking White Papers
- Optimizing Networks for the Cloud
- Join guest speaker, Rohit Mehra, IDC Director of Enterprise Communications Infrastructure, to explore current trends, discuss best practices for optimizing Data Center and...
- Unified Communications 101
- What's the best way to implement a unified communications solution for your organization?
- Try the OptiView® XG on your network - FREE
- The OptiView® XG is the first dedicated tablet with automated network and application analysis -- fastest way to root cause. XG raises the...
- Apps QuickStart Series Part 2: Designing and Deploying SQL Server on VMware vSphere
- Download this webcast to learn about the design considerations for virtualizing SQL workloads, performance and scalability information and high-availability options, as well as...
- Apps QuickStart Series Part 1: Designing and Deploying Exchange 2010 on VMware vSphere
- Download this webcast to learn the virtual hardware design considerations for Exchange 2010, deployment using the building block approach, options for high-availability and... All Networking Webcasts