Computerworld - Stolen credit card numbers, hacked federal computer systems and other high-profile online assaults have put many users on their guards and focused the attention of security managers on high-level intrusion-detection systems, chains of firewalls and other high-level defenses. But many forget that, no matter how hard they try to secure a site, vulnerabilities built into the fabric of the Internet still leave them at risk - even though measures to shut down the most glaringly common vulnerabilities are easily available.
Simple functions like the ability to request a connection between two machines can create openings that are to blame in about 15% of the attacks that are reported each year, says Fred Baker, chairman of the Internet Engineering Task Force. That's because TCP/IP hasn't changed much since the days of its acceptance as the Arpanet transport protocol.
"[Internet Protocol] was originally written among a cohesive community that had significant internal trust. By default, IP applications assume they should trust people," Baker says.
Denial-of-service and data hijacking attacks using functions of TCP/IP can be prevented using security functions that can be turned on in most server operating systems, filters built into routers or a new version of IP (Version 6), which is a standard for the public-key infrastructure IPSec protocol.
But those security measures are often ignored.
Take the TCP attack that was "rediscovered" in March by security services firm Guardent Inc. in Waltham, Mass. Guardent researchers figured out a new way to exploit an old problem with TCP: the ability of a hacker to hijack a session if he can guess the random initial sequence number (ISN) that two machines use to start a sequence of packets.
Once an attacker guesses the ISN, he can redirect the packets or inject anything into the data stream. Software vendors were thought to have averted this problem with random packet sequence generators. Turns out those random sequences aren't so random after all and actually contain patterns that make the ISN easy to guess, says Jerry Brady, vice president of research and development at Guardent.
Another ancient exploit, spoofing IP addresses, is also common today, says Paul Raines, head of global information risk management at Barclays Capital, an investment bank in New York.
"Classic TCP/IP attacks such as IP spoofing and denial-of-service attacks using buffer overflows are still out there," he says. "Take the [distributed denial-of-service] attack executed by Mafia Boy last year. He planted Trojan horses in unsuspecting servers. Those servers then flooded e-commerce sites with a load of service requests that contained bogus-source IP addresses. The e-commerce sites couldn't keep
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- What Datapipe customers need to know about the new PCI DSS 3.0 compliance standard This handy quick reference outlines what PCI DSS 3.0 is, who needs to be compliant and how Alert Logic solutions address the new...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- The Critical Role of Support in Your Enterprise Mobility Management Strategy Most business leaders underestimate the importance of tech support when they choose an EMM solution. Here's what to put on your checklist.
- Separating Work and Personal at the Platform Level: How BlackBerry Balance Works BlackBerry® Balance™ separates work from personal on the same mobile device, right at a platform level. Find out how it can work for...
- Live Webcast Best Practices for the Hyperconverged Enterprise Network To the Age of Constant Connectivity and Information overload
- Getting Ready for BlackBerry Enterprise Service 10.2 Find out how BlackBerry® Enterprise Service 10 helps organizations address the full spectrum of EMM challenges, while balancing the needs of both the...
- Containerization Options: How to Choose the Best DLP Solution for Your Organization This webcast outlines a framework for making the right choice when it comes to containerization approaches, along with the pros and cons of... All Networking White Papers | Webcasts