459 lines
19 KiB
Plaintext
459 lines
19 KiB
Plaintext
Sniffer FAQ
|
|
|
|
Version: 1.7
|
|
-------------------------------------------------------------------------------
|
|
This Security FAQ is a resource provided by:
|
|
|
|
Internet Security Systems, Inc.
|
|
2000 Miller Court West Tel: (770) 441-2531
|
|
Norcross, Georgia 30071 Fax: (770) 441-2431
|
|
|
|
- Internet Scanner ... the most comprehensive "attack simulator"
|
|
available. -
|
|
|
|
-------------------------------------------------------------------------------
|
|
To get the newest updates of Security files check the following services:
|
|
|
|
mail info@iss.net with "send index" in message
|
|
http://iss.net/
|
|
ftp iss.net /pub/
|
|
|
|
-------------------------------------------------------------------------------
|
|
This Sniffer FAQ will hopefully give administrators a clear understanding of
|
|
sniffing problems and hopefully possible solutions to follow up with. Sniffers
|
|
is one of the main causes of mass break-ins on the Internet today.
|
|
|
|
This FAQ will be broken down into:
|
|
|
|
* What a sniffer is and how it works
|
|
* Where are sniffers available
|
|
* How to detect if a machine is being sniffed
|
|
* Stopping sniffing attacks:
|
|
o Active hubs
|
|
o Encryption
|
|
o Kerberos
|
|
o One-time password technology
|
|
o Non-promiscuous interfaces
|
|
|
|
-------------------------------------------------------------------------------
|
|
|
|
What a sniffer is and how it works
|
|
|
|
Unlike telephone circuits, computer networks are shared communication channels.
|
|
It is simply too expensive to dedicate local loops to the switch (hub) for each
|
|
pair of communicating computers. Sharing means that computers can receive
|
|
information that was intended for other machines. To capture the information
|
|
going over the network is called sniffing.
|
|
|
|
Most popular way of connecting computers is through ethernet. Ethernet protocol
|
|
works by sending packet information to all the hosts on the same circuit. The
|
|
packet header contains the proper address of the destination machine. Only the
|
|
machine with the matching address is suppose to accept the packet. A machine
|
|
that is accepting all packets, no matter what the packet header says, is said
|
|
to be in promiscuous mode.
|
|
|
|
Because, in a normal networking environment, account and password information
|
|
is passed along ethernet in clear-text, it is not hard for an intruder once
|
|
they obtain root to put a machine into promiscuous mode and by sniffing,
|
|
compromise all the machines on the net.
|
|
|
|
-------------------------------------------------------------------------------
|
|
|
|
Where are sniffers available
|
|
|
|
Sniffing is one of the most popular forms of attacks used by hackers. One
|
|
special sniffer, called Esniff.c, is very small, designed to work on Sunos, and
|
|
only captures the first 300 bytes of all telnet, ftp, and rlogin sessions. It
|
|
was published in Phrack, one of the most widely read freely available
|
|
underground hacking magazines. You can find Phrack on many FTP sites. Esniff.c
|
|
is also available on many FTP sites such as coombs.anu.edu.au:/pub/net/log.
|
|
|
|
You may want to run Esniff.c on an authorized network to quickly see how
|
|
effective it is in compromising local machines.
|
|
|
|
Other sniffers that are widely available which are intended to debug network
|
|
problems are:
|
|
|
|
* Etherfind on SunOs4.1.x
|
|
* Snoop on Solaris 2.x and SunOs 4.1 (on ftp playground.sun.com)
|
|
* Tcpdump 3.0 uses bpf for a multitude of platforms.
|
|
* Packetman, Interman, Etherman, Loadman works on the following platforms:
|
|
SunOS, Dec-Mips, SGI, Alpha, and Solaris. It is available on
|
|
ftp.cs.curtin.edu.au:/pub/netman/[sun4c|dec-mips|sgi|alpha|solaris2]/
|
|
[etherman-1.1a|interman-1.1|loadman-1.0|packetman-1.1].tar.Z
|
|
Packetman was designed to capture packets, while Interman, Etherman, and
|
|
Loadman monitor traffic of various kinds.
|
|
|
|
DOS based sniffers
|
|
|
|
* Gobbler for IBM DOS Machines
|
|
* ethdump v1.03
|
|
Available on ftp
|
|
ftp.germany.eu.net:/pub/networking/inet/ethernet/ethdp103.zip
|
|
* ethload v1.04
|
|
Companion utility to a ethernet monitor. Available on ftp
|
|
ftp.germany.eu.net:/pub/networking/monitoring/ethload/ethld104.zip
|
|
|
|
Commercial Sniffers are available at:
|
|
|
|
* Network General.
|
|
|
|
Network General produces a number of products. The most
|
|
important are the Expert Sniffer, which not only sniffs on the
|
|
wire, but also runs the packet through a high-performance expert
|
|
system, diagnosing problems for you. There is an extension onto
|
|
this called the "Distributed Sniffer System" that allows you to
|
|
put the console to the expert sniffer on you Unix workstation
|
|
and to distribute the collection agents at remote sites.
|
|
|
|
* Microsoft's Net Monitor
|
|
|
|
" My commercial site runs many protocols on one wire - NetBeui,
|
|
IPX/SPX, TCP/IP, 802.3 protocols of various flavors, most
|
|
notably SNA. This posed a big problem when trying to find a
|
|
sniffer to examine the network problems we were having, since I
|
|
found that some sniffers that understood Ethernet II parse out
|
|
some 802.3 traffic as bad packets, and vice versa. I found that
|
|
the best protocol parser was in Microsoft's Net Monitor product,
|
|
also known as Bloodhound in its earlier incarnations. It is able
|
|
to correctly identify such oddities as NetWare control packets,
|
|
NT NetBios name service broadcasts, etc, which etherfind on a
|
|
Sun simply registered as type 0000 packet broadcasts. It
|
|
requires MS Windows 3.1 and runs quite fast on a HP XP60 Pentium
|
|
box. Top level monitoring provides network statistics and
|
|
information on conversations by mac address (or hostname, if you
|
|
bother with an ethers file). Looking at tcpdump style details is
|
|
as simple as clicking on a conversation. The filter setup is
|
|
also one of the easiest to implement that I've seen, just click
|
|
in a dialog box on the hosts you want to monitor. The number of
|
|
bad packets it reports on my network is a tiny fraction of that
|
|
reported by other sniffers I've used. One of these other
|
|
sniffers in particular was reporting a large number of bad
|
|
packets with src mac addresses of aa:aa:aa:aa:aa:aa but I don't
|
|
see them at all using the MS product. - Anonymous
|
|
|
|
-------------------------------------------------------------------------------
|
|
|
|
How to detect a sniffer running.
|
|
|
|
To detect a sniffing device that only collects data and does not respond to any
|
|
of the information, requires physically checking all your ethernet connections
|
|
by walking around and checking the ethernet connections individually.
|
|
|
|
It is also impossible to remotely check by sending a packet or ping if a
|
|
machine is sniffing.
|
|
|
|
A sniffer running on a machine puts the interface into promiscuous mode, which
|
|
accepts all the packets. On some Unix boxes, it is possible to detect a
|
|
promiscuous interface. It is possible to run a sniffer in non-promiscuous mode,
|
|
but it will only capture sessions from the machine it is running on. It is also
|
|
possible for the intruder to do similiar capture of sessions by trojaning many
|
|
programs such as sh, telnet, rlogin, in.telnetd, and so on to write a log file
|
|
of what the user did. They can easily watch the tty and kmem devices as well.
|
|
These attacks will only compromise sessions coming from that one machine, while
|
|
promiscuous sniffing compromises all sessions on the ethernet.
|
|
|
|
For SunOs, NetBSD, and other possible BSD derived Unix systems, there is a
|
|
command
|
|
|
|
"ifconfig -a"
|
|
|
|
that will tell you information about all the interfaces and if they are in
|
|
promiscuous mode. DEC OSF/1 and IRIX and possible other OSes require the device
|
|
to be specified. One way to find out what interface is on the system, you can
|
|
execute:
|
|
|
|
# netstat -r
|
|
Routing tables
|
|
|
|
Internet:
|
|
Destination Gateway Flags Refs Use Interface
|
|
default iss.net UG 1 24949 le0
|
|
localhost localhost UH 2 83 lo0
|
|
|
|
Then you can test for each interface by doing the following command:
|
|
|
|
#ifconfig le0
|
|
le0: flags=8863<UP,BROADCAST,NOTRAILERS,RUNNING,PROMISC,MULTICAST>
|
|
inet 127.0.0.1 netmask 0xffffff00 broadcast 255.0.0.1
|
|
|
|
Intruders often replace commands such as ifconfig to avoid detection. Make sure
|
|
you verify its checksum.
|
|
|
|
There is a program called cpm available on ftp.cert.org:/pub/tools/cpm that
|
|
only works on Sunos and is suppose to check the interface for promiscuous flag.
|
|
|
|
Ultrix can possibly detect someone running a sniffer by using the commands
|
|
pfstat and pfconfig.
|
|
|
|
pfconfig allows you to set who can run a sniffer
|
|
pfstat shows you if the interface is in promiscuous mode.
|
|
|
|
These commands only work if sniffing is enabled by linking it into the kernel.
|
|
by default, the sniffer is not linked into the kernel. Most other Unix systems,
|
|
such as Irix, Solaris, SCO, etc, do not have any flags indication whether they
|
|
are in promiscuous mode or not, therefore an intruder could be sniffing your
|
|
whole network and there is no way to detect it.
|
|
|
|
Often a sniffer log becomes so large that the file space is all used up. On a
|
|
high volume network, a sniffer will create a large load on the machine. These
|
|
sometimes trigger enough alarms that the administrator will discover a sniffer.
|
|
I highly suggest using lsof (LiSt Open Files) available from
|
|
coast.cs.purdue.edu:/pub/Purdue/lsof for finding log files and finding programs
|
|
that are accessing the packet device such as /dev/nit on SunOs.
|
|
|
|
There is no commands I know of to detect a promiscuous IBM PC compatible
|
|
machine, but they atleast usually do not allow command execution unless from
|
|
the console, therefore remote intruders can not turn a PC machine into a
|
|
sniffer without inside assistance.
|
|
|
|
-------------------------------------------------------------------------------
|
|
|
|
Stopping sniffing attacks
|
|
|
|
Active hubs send to each system only packets intended for it rendering
|
|
promiscuous sniffing useless. This is only effective for 10-Base T.
|
|
|
|
The following vendors have available active hubs:
|
|
|
|
* 3Com
|
|
* HP
|
|
|
|
-------------------------------------------------------------------------------
|
|
|
|
Encryption
|
|
|
|
There are several packages out there that allow encryption between connections
|
|
therefore an intruder could capture the data, but could not decypher it to make
|
|
any use of it.
|
|
|
|
Some packages available are:
|
|
|
|
* deslogin is one package available at ftp
|
|
coast.cs.purdue.edu:/pub/tools/unix/deslogin .
|
|
|
|
* swIPe is another package available at
|
|
ftp.csua.berkeley.edu:/pub/cypherpunks/swIPe/
|
|
|
|
* Netlock encrypts all (tcp, udp, and raw ip based) communications
|
|
transparently. It has automatic (authenticated Diffie-Helman) distibuted
|
|
key management mechanism for each host and runs on the SUN 4.1 and HP 9.x
|
|
systems. The product comes with a Certification Authority Management
|
|
application which generates host certificates (X.509) used for
|
|
authentication between the hosts. and provides centralized control of each
|
|
Hosts communications rules.
|
|
|
|
The product is built by Hughes Aircraft and they can be reached at
|
|
800-825-LOCK or email at netlock@mls.hac.com.
|
|
|
|
-------------------------------------------------------------------------------
|
|
|
|
Kerberos
|
|
|
|
Kerberos is another package that encrypts account information going over the
|
|
network. Some of its draw backs are that all the account information is held on
|
|
one host and if that machine is compromised, the whole network is vulnerable.
|
|
It is has been reported a major difficulty to set up. Kerberos comes with a
|
|
stream-encrypting rlogind, and stream-encrypting telnetd is available. This
|
|
prevents intruders from capturing what you did after you logged in.
|
|
|
|
There is a Kerberos FAQ at ftp at rtfm.mit.edu in
|
|
/pub/usenet/comp.protocols/kerberos/Kerberos_Users__Frequently_Asked_Questions_1.11
|
|
|
|
-------------------------------------------------------------------------------
|
|
|
|
One time password technology
|
|
|
|
S/key and other one time password technology makes sniffing account information
|
|
almost useless. S/key concept is having your remote host already know a
|
|
password that is not going to go over insecure channels and when you connect,
|
|
you get a challenge. You take the challenge information and password and plug
|
|
it into an algorithm which generates the response that should get the same
|
|
answer if the password is the same on the both sides. Therefore the password
|
|
never goes over the network, nor is the same challenge used twice. Unlike
|
|
SecureID or SNK, with S/key you do not share a secret with the host. S/key is
|
|
available on ftp:thumper.bellcore.com:/pub/nmh/skey
|
|
|
|
Other one time password technology is card systems where each user gets a card
|
|
that generates numbers that allow access to their account. Without the card, it
|
|
is improbable to guess the numbers.
|
|
|
|
The following are companies that offer solutions that are provide better
|
|
password authenication (ie, handheld password devices):
|
|
|
|
Secure Net Key (SNK)
|
|
|
|
Digital Pathways, Inc.
|
|
201 Ravendale Dr. Mountainview, Ca.
|
|
97703-5216 USA
|
|
|
|
Phone: 415-964-0707 Fax: (415) 961-7487
|
|
|
|
Secure ID
|
|
|
|
Security Dynamics,
|
|
One Alewife Center
|
|
Cambridge, MA 02140-2312
|
|
USA Phone: 617-547-7820
|
|
Fax: (617) 354-8836
|
|
Secure ID uses time slots as authenication rather than challenge/response.
|
|
|
|
ArKey and OneTime Pass
|
|
|
|
Management Analytics
|
|
PO Box 1480
|
|
Hudson, OH 44236
|
|
Email: fc@all.net
|
|
Tel:US+216-686-0090 Fax: US+216-686-0092
|
|
|
|
OneTime Pass (OTP):
|
|
This program provides unrestricted one-time pass codes on a user by user basis
|
|
without any need for cryptographic protocols or hardware devices. The user
|
|
takes a list of usable pass codes and scratches out each one as it is used. The
|
|
system tracks usage, removing each passcode from the available list when it is
|
|
used. Comes with a very small and fast password tester and password and pass
|
|
phrase generation systems.
|
|
|
|
ArKey:
|
|
This is the original Argued Key system that mutually authenticates users and
|
|
systems to each other based on their common knowledge. No hardware necessary.
|
|
Comes with a very small and fast password tester and password and pass phrase
|
|
generation systems.
|
|
|
|
WatchWord and WatchWord II
|
|
|
|
Racal-Guardata
|
|
480 Spring Park Place
|
|
Herndon, VA 22070
|
|
703-471-0892
|
|
1-800-521-6261 ext 217
|
|
|
|
CRYPTOCard
|
|
|
|
Arnold Consulting, Inc.
|
|
2530 Targhee Street, Madison, Wisconsin
|
|
53711-5491 U.S.A.
|
|
Phone : 608-278-7700 Fax: 608-278-7701
|
|
Email: Stephen.L.Arnold@Arnold.Com
|
|
CRYPTOCard is a modern, SecureID-sized, SNK-compatible device.
|
|
|
|
SafeWord
|
|
|
|
Enigma Logic, Inc.
|
|
2151 Salvio #301
|
|
Concord, CA 94520
|
|
510-827-5707 Fax: (510)827-2593
|
|
For information about Enigma ftp to: ftp.netcom.com in directory
|
|
/pub/sa/safeword
|
|
|
|
Secure Computing Corporation:
|
|
|
|
2675 Long Lake Road
|
|
Roseville, MN 55113
|
|
Tel: (612) 628-2700
|
|
Fax: (612) 628-2701
|
|
debernar@sctc.com
|
|
|
|
-------------------------------------------------------------------------------
|
|
|
|
Non-promiscuous Interfaces
|
|
|
|
You can try to make sure that most IBM DOS compatible machines have interfaces
|
|
that will not allow sniffing. Here is a list of cards that do not support
|
|
promiscuous mode:
|
|
|
|
Test the interface for promiscuous mode by using the Gobbler. If you find a
|
|
interface that does do promiscuous mode and it is listed here, please e-mail
|
|
cklaus@iss.net so I can remove it ASAP.
|
|
|
|
IBM Token-Ring Network PC Adapter
|
|
IBM Token-Ring Network PC Adapter II (short card)
|
|
IBM Token-Ring Network PC Adapter II (long card)
|
|
IBM Token-Ring Network 16/4 Adapter
|
|
IBM Token-Ring Network PC Adapter/A
|
|
IBM Token-Ring Network 16/4 Adapter/A
|
|
IBM Token-Ring Network 16/4 Busmaster Server Adapter/A
|
|
|
|
The following cards are rumoured to be unable to go into promiscuous mode, but
|
|
that the veracity of those rumours is doubtful.
|
|
|
|
Microdyne (Excelan) EXOS 205
|
|
Microdyne (Excelan) EXOS 205T
|
|
Microdyne (Excelan) EXOS 205T/16
|
|
Hewlett-Packard 27250A EtherTwist PC LAN Adapter Card/8
|
|
Hewlett-Packard 27245A EtherTwist PC LAN Adapter Card/8
|
|
Hewlett-Packard 27247A EtherTwist PC LAN Adapter Card/16
|
|
Hewlett-Packard 27248A EtherTwist EISA PC LAN Adapter Card/32
|
|
HP 27247B EtherTwist Adapter Card/16 TP Plus
|
|
HP 27252A EtherTwist Adapter Card/16 TP Plus
|
|
HP J2405A EtherTwist PC LAN Adapter NC/16 TP
|
|
|
|
Adapters based upon the TROPIC chipset generally do not support promiscuous
|
|
mode. The TROPIC chipset is used in IBM's Token Ring adapters such as the 16/4
|
|
adapter. Other vendors (notably 3Com) also supply TROPIC based adapters.
|
|
TROPIC-based adapters do accept special EPROMs, however, that will allow them
|
|
to go into promiscuous mode. However, when in promiscuous mode, these adapters
|
|
will spit out a "Trace Tool Present" frame.
|
|
|
|
-------------------------------------------------------------------------------
|
|
|
|
Acknowledgements
|
|
|
|
I would like to thank the following people for the contribution to this FAQ
|
|
that has helped to update and shape it:
|
|
|
|
* Padgett Peterson (padgett@tccslr.dnet.mmc.com)
|
|
* Steven Bellovin (smb@research.att.com)
|
|
* Wietse Venema (wietse@wzv.win.tue.nl)
|
|
* Robert D. Graham (robg@NGC.COM)
|
|
* Kevin Martinez (kevinm@beavis.qntm.com)
|
|
* Frederick B. Cohen (fc@all.net)
|
|
* James Bonfield (jkb@mrc-lmb.cam.ac.uk)
|
|
* Marc Horowitz (marc@MIT.EDU)
|
|
* Steve Edwards (steve@newline.com)
|
|
* Andy Poling (Andy.Poling@jhu.edu)
|
|
* Jeff Collyer (jeff@cnet-pnw.com)
|
|
* Sara Gordon (sgordon@sun1.iusb.indiana.edu)
|
|
|
|
-------------------------------------------------------------------------------
|
|
|
|
Copyright
|
|
|
|
This paper is Copyright (c) 1994, 1995
|
|
by Christopher Klaus of Internet Security Systems, Inc.
|
|
|
|
Permission is hereby granted to give away free copies electronically. You may
|
|
distribute, transfer, or spread this paper electronically. You may not pretend
|
|
that you wrote it. This copyright notice must be maintained in any copy made.
|
|
If you wish to reprint the whole or any part of this paper in any other medium
|
|
(ie magazines, books, etc) excluding electronic medium, please ask the author
|
|
for permission.
|
|
|
|
Disclaimer
|
|
|
|
The information within this paper may change without notice. Use of this
|
|
information constitutes acceptance for use in an AS IS condition. There are NO
|
|
warranties with regard to this information. In no event shall the author be
|
|
liable for any damages whatsoever arising out of or in connection with the use
|
|
or spread of this information. Any use of this information is at the user's own
|
|
risk.
|
|
|
|
Address of Author
|
|
|
|
Please send suggestions, updates, and comments to:
|
|
Christopher Klaus <cklaus@iss.net> of Internet Security Systems, Inc.
|
|
<iss@iss.net>
|
|
|
|
Internet Security Systems, Inc.
|
|
|
|
Internet Security Systems, Inc, located in Atlanta, Ga., specializes in the
|
|
developement of security scanning software tools. Its flagship product,
|
|
Internet Scanner, is software that learns an organization's network and probes
|
|
every device on that network for security holes. It is the most comprehensive
|
|
"attack simulator" available, checking for over 100 security vulnerabilities.
|
|
|
|
--
|
|
Christopher William Klaus Voice: (404)441-2531. Fax: (404)441-2431
|
|
Internet Security Systems, Inc. Computer Security Consulting
|
|
2000 Miller Court West, Norcross, GA 30071
|