| Tools | Juggernaut is basically a network sniffer that can also be used to hijack TCP sessions. It runs on Linux and has a Trinux module as well. Juggernaut can be activated to watch all network traffic on the local network. |
For example, Juggernaut can be configured to wait for the login prompt, and then record the network traffic that follows (usually capturing the password). By doing so, this tool can be used to capture certain types of traffic by simply leaving the tool running for a few days, and then the attacker just has to pick up the log file that contains the recorded traffic. This is different than regular network sniffers that record all network traffic making the log files extremely huge (and thus easy to detect).
However, the main feature of this program is its ability to maintain a connection database. This means an attacker can watch all the TCP based connection made on the local network, and possibly "hijack" the session. After the connection is made, the attacker can watch the entire session (for a telnet session, this means the attacker sees the "playback" of the entire session. This is like actually seeing the telnet window).
When an active session is watched, the attacker can perform some actions on that connection, besides passively watching it. Juggernaut is capable of resetting the connection (which basically means terminating it), and also hijacking the connection, allowing the attacker to insert commands in the session or even to completely take the session into his hands (resetting connection on the legitimate client).
| Tools | Hunt is designed by Pavel Krauz. Hunt is considered by many to be one of the best session hijacking tools available because it is well written and has a comprehensive feature set. The hunt doesn't distinguish between local network connections and connections going to/from Internet. It can handle all connections it sees. Connection hijacking is aimed primarily at the telnet or rlogin traffic. In the words of its author, "the main goal of the HUNT project is to develop [a] tool for exploiting well known weaknesses in the TCP/IP protocol suite". |
The features of version 1.5 of Hunt include:
- Detection and watching of active connections.
- Insertion of commands into a session: With ARP spoofing the user can force the Switch to send the traffic for hosts on another segment/switched port. This may not work if the Switch has some security policy and MACs have been explicitly set up on a per port basis but in reality this configuration is hardly done on an "ordinary" network.
- Total takeover of a session.
- Synchronization of the original client with the server after a hijack: This is one of the main features of hunt. If the user inputs some data to the TCP stream (through simple active attack or ARP spoofing), he can desynchronize the stream from the server/original client point of view. He can also synchronize the connection after his objective is met. The main goal behind this is to synchronize the sequence numbers on both client and server again.
- Connection reset: With a single properly constructed packet the user can reset the connection (RST flag in TCP header). User can reset server, client, or both. When user resets only one end the other end is reset. This is because when it tries to send data to the first host it will respond with RST as the connection is already.
- Network sniffing with the ability to search for a particular string.
- Handling of ACK storms with ARP (Address Resolution Protocol) spoofing: User can insert packets to the network (rerouting) it receives from ARP spoofed hosts.
Illustration
- Alice opens a telnet session to Bob and starts doing some work.
- Eve uses Hunt to observe all connections passing her location on the network. Seeing the connection between Alice and Bob, Eve selects it for hijacking.
- Eve sends an ARP reply to Alice, mapping Bob's IP address to a MAC address that does not exist on the LAN segment.
- Eve sends an ARP reply to Bob, mapping Alice's IP address to a MAC address that does not exist on the LAN segment.
- Alice and Bob will try to send data to each other, but because their respective ARP caches contain mappings to non-existent MAC addresses, the data will not arrive at the intended destination. However, Eve, who is strategically located in the middle and listening in promiscuous mode, is able to capture all traffic between Alice and Bob.
- Eve can use Hunt's ARP daemon to control the traffic between Alice and Bob. She can insert commands, completely take over the session or simply relay all the traffic between Alice and Bob. Bob thinks that he is still connected with Alice. Alice will notice a lack of response from Bob if Eve hijacks the session. During the hijack there will not be an ACK storm because Alice is not receiving data from Bob.
- Eve must be located on a network segment that is passing traffic between Alice and Bob. in order that other connections on the network are not affected by Eve's attack, Eve uses Hunt's ARP relay daemon to relay the data for some of these connections.
| Tools | TTY-Watcher is a utility to monitor and control users on a single system. It is based on our IP-Watcher utility, which can be used to monitor and control users on an entire network. It is similar to advice or tap, but with many, more advanced features and a user friendly (either X-Windows or text) interface |
TTY-Watcher allows the user to monitor every tty on the system, as well as interact with them by:
- Sharing a TTY. Anything the user types into a monitored TTY window will be sent to the underlying process (and consequently echoed back to the real owner of the TTY). In this way, the user is "sharing" a login session with another user.
- Termination. At the click of a button (or an escape sequence with the text interface), the current connection can be instantly terminated.
- Stealing. Another click of the button allows the user to "steal" the monitored TTY. The TTY will continue to function as normal for the TTY-Watcher user, but the real owner of the TTY will see no output, and his keystrokes will be ignored.
- Returning the TTY. After a TTY has been stolen, it can be returned to the user, as though nothing happened.
- Sending the user a message. A message can be sent to the real owner of the TTY without interfering with the commands he's typing. The message will only be displayed on his screen and will not be sent to the underlying process.
Aside from monitoring and controlling TTYs, individual connections can be logged to either a raw logfile for later playback or to a text file. Currently TTY-Watcher works under SunOS 4.x and Solaris 2.x systems.
| Tools | IP-Watcher is a network security and administration tool that can control any login session on the network. IP-Watcher is an extremely valuable tool for investigating suspicious activity, obtaining evidence of misuse, and also to obstruct malicious users before they do any damage. This network monitoring tool can be used to inspect the data being transferred between two hosts. It can monitor all the connections on a network, allowing the user to display an exact copy of a session in real-time, just as the user of the session sees the data. |
From an attacker's perspective, IP-Watcher lets him hijack an IP session by clandestinely diverting the victim to a rogue computer, where he will be tricked into thinking that he is still at the legitimate IP address. When the tool is used for legitimate purposes, it can gather evidence against the attacker. In the words of the author, "These connections are an intruder's footprints, and the best way to catch the intruder is to have an advanced visualization of those footprints."
The Windows version of IP-Watcher is T-sight. There are a number of ways an attacker can use IP-Watcher. IP-Watcher can create network traffic with spoofed source and destination addresses. This makes it possible to kill any user's connection. This could be used to deny access to a legitimate user.
When IP-Watcher terminates a user's connection while trying to log in, it appears to the user as a network fault. If the user tries to log in again, IP-Watcher can divert his connection so that it steals the user's password. If a system administrator uses the "su" command to enter a root account, IP-Watcher will sniff the clear text password through its ability to log keystrokes. It can be configures to log what it sniffs into small files. This can prevents the sysadmin from discovering a hidden sniffer by looking for unexplained large files. IP-Watcher can be used to hijack a connection by a trusted user using a one time password. While the user is going about his or her business, the intruder can be secretly using the same connection to install back doors.
| Attack Methods | T-sight, is an advanced intrusion investigation and response tool for Windows NT and Windows 2000 platforms. It can assist when an attempt at a break-in or a compromise occurs. It is an automatic intrusion detection system. However, it can be configured to activate when certain transactions take place. |
It is specifically designed to investigate user defines activity and then let the user take action to stop the attack (take over or terminate the connection). T-sight supplements the authentication program, which can be circumvented through session hijacking or a backdoor left by an attacker. It can interpret connections for telnet, rlogin, ftp, smtp, sib, rsh and http. The program presents a customizable interface listing the connections established on the netw ork.
This security tool can remotely display all active sessions on a terminal server, router, dial-in server, access server, etc. The user can reset any TCP session remotely.
Resetting a connection is simple.
- Start up the remote TCP session reset
- Enter the IP address of the machine whose connection is to be reset.
- Enter the read-write community string.
- Click on connect to retrieve a list of active TCP connections
- Click on the connection that is to be disconnected, and select 'Break' from the toolbar.
| Countermeasure | When practical, limit successful sessions to specific IP addresses. This usually only works when dealing within an intranet setting, where the IP ranges are predictable and finite. |
| Countermeasure | Re-authenticate the user before critical actions are performed. If possible, try to limit unique session tokens to each browser instance (e.g. generate the token with a hash of the MAC address of the computer and process id of the browser, etc.) Configure the appropriate spoof rules on gateways (internal and external). Monitor for ARP cache poisoning, by using IDS products or ARPwatch. |
| Countermeasure | Use x.509 certificates to prevent more traditional types of TCP hijacking. |
| Countermeasure | Use encryption. This can be done by one or more of the following.
|
| Countermeasure | Use strong authentication (like Kerberos) or peer-to-peer VPN's. |
- In the case of a session hijacking an attacker relies on the legitimate user to connect and authenticate and then take over the session.
- In spoofing attack, the attacker pretends to be another user or machine to gain access.
- Successful session hijacking is extremely difficult and only possible when a number of factors are under the attacker s control.
- Session hijacking can be active or passive in nature depending on the degree of involvement of the attacker in the attack.
- A variety of tools exist to aid the attacker in perpetrating a session hijack.
- Session Hijacking could be very dangerous and there is a need for implementing strict countermeasures.
COMMENTS