SuperHack/SuperHack CD.bin/Hack/MISC/SNIFFER.ZIP/SNIFFER.FAQ

Text File | 1996-05-24 | 20.0 KB | 549 lines

                                  SNIFFER FAQ

   Version: 1.7
     _________________________________________________________________

   This Security FAQ is a resource provided by:

Internet Security Systems, Inc.
5871 Glenridge Drive, Suite 115   Tel: [phone]
Atlanta, Georgia  30328           Fax: [phone]

     - Internet Scanner ... the most comprehensive "attack simulator"
     available. -


     _________________________________________________________________

   To get the newest updates of Security files check the following
   services:

     http://www.iss.net/
     ftp ftp.iss.net /pub/

   To subscibe to the update mailing list, Alert, send an e-mail to
   [e-mail] and, in the te xt of your message (not the
   subject line), write:

     subscribe alert


     _________________________________________________________________

   This Sniffer FAQ will hopefully give administrators a clear
   understanding of sniffing problems and hopefully possible solutions to
   follow up with. Sniffers is one of the main causes of mass break-ins
   on the Internet today.

   This FAQ will be broken down into:
     * What a sniffer is and how it works
     * Where are sniffers available
     * How to detect if a machine is being sniffed
     * Stopping sniffing attacks:
          + Active hubs
          + Encryption
          + Kerberos
          + One-time password technology
          + Non-promiscuous interfaces


     _________________________________________________________________



What a sniffer is and how it works

   Unlike telephone circuits, computer networks are shared communication
   channels. It is simply too expensive to dedicate local loops to the
   switch (hub) for each pair of communicating computers. Sharing means
   that computers can receive information that was intended for other
   machines. To capture the information going over the network is called
   sniffing.

   Most popular way of connecting computers is through ethernet.
   Ethernet protocol works by sending packet information to all the
   hosts on the same circuit. The packet header contains the proper
   address of the destination machine. Only the machine with the
   matching address is suppose to accept the packet. A machine that is
   accepting all packets, no matter what the packet header says, is said
   to be in promiscuous mode.

   Because, in a normal networking environment, account and password
   information is passed along ethernet in clear-text, it is not hard
   for an intruder once they obtain root to put a machine into
   promiscuous mode and by sniffing, compromise all the machines on the
   net.


     _________________________________________________________________



Where are sniffers available

   Sniffing is one of the most popular forms of attacks used by hackers.
   One special sniffer, called Esniff.c, is very small, designed to work
   on Sunos, and only captures the first 300 bytes of all telnet, ftp,
   and rlogin sessions. It was published in Phrack, one of the most
   widely read freely available underground hacking magazines. You can
   find Phrack on many FTP sites. Esniff.c is also available on many FTP
   sites such as coombs.anu.edu.au:/pub/net/log.

   You may want to run Esniff.c on an authorized network to quickly see
   how effective it is in compromising local machines.

   Other sniffers that are widely available which are intended to debug
   network problems are:

     * Etherfind on SunOs4.1.x
     * Snoop on Solaris 2.x and SunOs 4.1 (on ftp playground.sun.com)
     * Tcpdump 3.0 uses bpf for a multitude of platforms.
     * Packetman, Interman, Etherman, Loadman works on the following
       platforms:
       SunOS, Dec-Mips, SGI, Alpha, and Solaris. It is available on
       ftp.cs.curtin.edu.au:/pub/netman/[sun4c|dec-mips|sgi|alpha|solar
       is2]/
       [etherman-1.1a|interman-1.1|loadman-1.0|packetman-1.1].tar.Z
       Packetman was designed to capture packets, while Interman,
       Etherman, and Loadman monitor traffic of various kinds.

    DOS based sniffers


     * Gobbler for IBM DOS Machines
     * ethdump v1.03
       Available on ftp
       ftp.germany.eu.net:/pub/networking/inet/ethernet/ethdp103.zip
     * ethload v1.04
       Companion utility to a ethernet monitor. Available on ftp
       ftp.germany.eu.net:/pub/networking/monitoring/ethload/ethld104.z
       ip



   Commercial Sniffers are available at:

     * Klos Technologies, Inc.

     PacketView - Low cost network protocol analyzer

     Phone: [phone]
     BBS: 603-429-0032

     * Network General.

     Network General produces a number of products. The most important
     are the Expert Sniffer, which not only sniffs on the wire, but also
     runs the packet through a high-performance expert system, diagnosing
     problems for you. There is an extension onto this called the
     "Distributed Sniffer System" that allows you to put the console to
     the expert sniffer on you Unix workstation and to distribute the
     collection agents at remote sites.

     * Microsoft's Net Monitor

     " My commercial site runs many protocols on one wire - NetBeui,
     IPX/SPX, TCP/IP, 802.3 protocols of various flavors, most notably
     SNA. This posed a big problem when trying to find a sniffer to
     examine the network problems we were having, since I found that some
     sniffers that understood Ethernet II parse out some 802.3 traffic as
     bad packets, and vice versa. I found that the best protocol parser
     was in Microsoft's Net Monitor product, also known as Bloodhound in
     its earlier incarnations. It is able to correctly identify such
     oddities as NetWare control packets, NT NetBios name service
     broadcasts, etc, which etherfind on a Sun simply registered as type
     0000 packet broadcasts. It requires MS Windows 3.1 and runs quite
     fast on a HP XP60 Pentium box. Top level monitoring provides network
     statistics and information on conversations by mac address (or
     hostname, if you bother with an ethers file). Looking at tcpdump
     style details is as simple as clicking on a conversation. The filter
     setup is also one of the easiest to implement that I've seen, just
     click in a dialog box on the hosts you want to monitor. The number
     of bad packets it reports on my network is a tiny fraction of that
     reported by other sniffers I've used. One of these other sniffers in
     particular was reporting a large number of bad packets with src mac
     addresses of aa:aa:aa:aa:aa:aa but I don't see them at all using the
     MS product. - Anonymous


     _________________________________________________________________



How to detect a sniffer running.

   To detect a sniffing device that only collects data and does not
   respond to any of the information, requires physically checking all
   your ethernet connections by walking around and checking the ethernet
   connections individually.

   It is also impossible to remotely check by sending a packet or ping
   if a machine is sniffing.

   A sniffer running on a machine puts the interface into promiscuous
   mode, which accepts all the packets. On some Unix boxes, it is
   possible to detect a promiscuous interface. It is possible to run a
   sniffer in non-promiscuous mode, but it will only capture sessions
   from the machine it is running on. It is also possible for the
   intruder to do similiar capture of sessions by trojaning many
   programs such as sh, telnet, rlogin, in.telnetd, and so on to write
   a log file of what the user did. They can easily watch the tty and
   kmem devices as well. These attacks will only compromise sessions
   coming from that one machine, while promiscuous sniffing compromises
   all sessions on the ethernet.

   For SunOs, NetBSD, and other possible BSD derived Unix systems, there
   is a command

     "ifconfig -a"

   that will tell you information about all the interfaces and if they
   are in promiscuous mode. DEC OSF/1 and IRIX and possible other OSes
   require the device to be specified. One way to find out what
   interface is on the system, you can execute:

# netstat -r
Routing tables

Internet:
Destination      Gateway            Flags     Refs     Use  Interface
default          iss.net            UG          1    24949  le0
localhost        localhost          UH          2       83  lo0


   Then you can test for each interface by doing the following command:

#ifconfig le0
le0: flags=8863<UP,BROADCAST,NOTRAILERS,RUNNING,PROMISC,MULTICAST>
        inet 127.0.0.1 netmask 0xffffff00 broadcast 255.0.0.1


   Intruders often replace commands such as ifconfig to avoid detection.
   Make sure you verify its checksum.

   There is a program called cpm available on
   ftp.cert.org:/pub/tools/cpm that only works on Sunos and is suppose
   to check the interface for promiscuous flag.

   Ultrix can possibly detect someone running a sniffer by using the
   commands pfstat and pfconfig.

   pfconfig allows you to set who can run a sniffer
   pfstat shows you if the interface is in promiscuous mode.

   These commands only work if sniffing is enabled by linking it into the
   kernel. by default, the sniffer is not linked into the kernel. Most
   other Unix systems, such as Irix, Solaris, SCO, etc, do not have any
   flags indication whether they are in promiscuous mode or not,
   therefore an intruder could be sniffing your whole network and there
   is no way to detect it.

   Often a sniffer log becomes so large that the file space is all used
   up. On a high volume network, a sniffer will create a large load on
   the machine. These sometimes trigger enough alarms that the
   administrator will discover a sniffer. I highly suggest using lsof
   (LiSt Open Files) available from coast.cs.purdue.edu:/pub/Purdue/lsof
   for finding log files and finding programs that are accessing the
   packet device such as /dev/nit on SunOs.

   There is no commands I know of to detect a promiscuous IBM PC
   compatible machine, but they atleast usually do not allow command
   execution unless from the console, therefore remote intruders can not
   turn a PC machine into a sniffer without inside assistance.


     _________________________________________________________________



Stopping sniffing attacks

   Active hubs send to each system only packets intended for it
   rendering promiscuous sniffing useless. This is only effective for
   10-Base T.

   The following vendors have available active hubs:

     * 3Com

     * HP





     _________________________________________________________________



  ENCRYPTION

   There are several packages out there that allow encryption between
   connections therefore an intruder could capture the data, but could
   not decypher it to make any use of it.

   Some packages available are:

     * deslogin is one package available at ftp
       coast.cs.purdue.edu:/pub/tools/unix/deslogin .

     * swIPe is another package available at
       ftp.csua.berkeley.edu:/pub/cypherpunks/swIPe/

     * Netlock encrypts all (tcp, udp, and raw ip based) communications
       transparently. It has automatic (authenticated Diffie-Helman)
       distibuted key management mechanism for each host and runs on the
       SUN 4.1 and HP 9.x systems. The product comes with a Certification
       Authority Management application which generates host certificates
       (X.509) used for authentication between the hosts. and provides
       centralized control of each Hosts communications rules.

       The product is built by Hughes Aircraft and they can be reached at
       800-825-LOCK or email at [e-mail].




     _________________________________________________________________



  KERBEROS



   Kerberos is another package that encrypts account information going
   over the network. Some of its draw backs are that all the account
   information is held on one host and if that machine is compromised,
   the whole network is vulnerable. It is has been reported a major
   difficulty to set up. Kerberos comes with a stream-encrypting
   rlogind, and stream-encrypting telnetd is available. This prevents
   intruders from capturing what you did after you logged in.

   There is a Kerberos FAQ at ftp at rtfm.mit.edu in
   /pub/usenet/comp.protocols/kerberos/Kerberos_Users__Frequently_Asked_
   Questions_1.11


     _________________________________________________________________



  ONE TIME PASSWORD TECHNOLOGY



   S/key and other one time password technology makes sniffing account
   information almost useless. S/key concept is having your remote host
   already know a password that is not going to go over insecure
   channels and when you connect, you get a challenge. You take the
   challenge information and password and plug it into an algorithm
   which generates the response that should get the same answer if the
   password is the same on the both sides. Therefore the password never
   goes over the network, nor is the same challenge used twice. Unlike
   SecureID or SNK, with S/key you do not share a secret with the host.
   S/key is available on ftp:thumper.bellcore.com:/pub/nmh/skey

   Other one time password technology is card systems where each user
   gets a card that generates numbers that allow access to their account.
   Without the card, it is improbable to guess the numbers.

   The following are companies that offer solutions that are provide
   better password authenication (ie, handheld password devices):


    Secure Net Key (SNK)

   Digital Pathways, Inc.
   201 Ravendale Dr. Mountainview, Ca.
   97703-5216 USA

   Phone: [phone] Fax: [phone]


    Secure ID

   Security Dynamics,
   One Alewife Center
   Cambridge, MA 02140-2312
   USA Phone: [phone]
   Fax: [phone]
   Secure ID uses time slots as authenication rather than
   challenge/response.


    ArKey and OneTime Pass

   Management Analytics
   PO Box 1480
   Hudson, OH 44236
   Email: [e-mail]
   Tel:US+216-686-0090 Fax: US+216-686-0092

   OneTime Pass (OTP):
   This program provides unrestricted one-time pass codes on a user by
   user basis without any need for cryptographic protocols or hardware
   devices. The user takes a list of usable pass codes and scratches out
   each one as it is used. The system tracks usage, removing each
   passcode from the available list when it is used. Comes with a very
   small and fast password tester and password and pass phrase generation
   systems.

   ArKey:
   This is the original Argued Key system that mutually authenticates
   users and systems to each other based on their common knowledge. No
   hardware necessary. Comes with a very small and fast password tester
   and password and pass phrase generation systems.

    WatchWord and WatchWord II

   Racal-Guardata
   480 Spring Park Place
   Herndon, VA 22070
   703-471-0892
   1-800-521-6261 ext 217


    CRYPTOCard

   Arnold Consulting, Inc.
   2530 Targhee Street, Madison, Wisconsin
   53711-5491 U.S.A.
   Phone : [phone] Fax: [phone]
   Email: [e-mail]
   CRYPTOCard is a modern, SecureID-sized, SNK-compatible device.


    SafeWord

   Enigma Logic, Inc.
   2151 Salvio #301
   Concord, CA 94520
   510-827-5707 Fax: [phone]
   For information about Enigma ftp to: ftp.netcom.com in directory
   /pub/sa/safeword


    Secure Computing Corporation:

   2675 Long Lake Road
   Roseville, MN 55113
   Tel: [phone]
   Fax: [phone]
   [e-mail]


     _________________________________________________________________



  NON-PROMISCUOUS INTERFACES



   You can try to make sure that most IBM DOS compatible machines have
   interfaces that will not allow sniffing. Here is a list of cards that
   do not support promiscuous mode:

   Test the interface for promiscuous mode by using the Gobbler. If you
   find a interface that does do promiscuous mode and it is listed
   here, please e-mail [e-mail] so I can remove it ASAP.

     IBM Token-Ring Network PC Adapter
     IBM Token-Ring Network PC Adapter II (short card)
     IBM Token-Ring Network PC Adapter II (long card)
     IBM Token-Ring Network 16/4 Adapter
     IBM Token-Ring Network PC Adapter/A
     IBM Token-Ring Network 16/4 Adapter/A
     IBM Token-Ring Network 16/4 Busmaster Server Adapter/A

   The following cards are rumoured to be unable to go into promiscuous
   mode, but that the veracity of those rumours is doubtful.

     Microdyne (Excelan) EXOS 205
     Microdyne (Excelan) EXOS 205T
     Microdyne (Excelan) EXOS 205T/16
     Hewlett-Packard 27250A EtherTwist PC LAN Adapter Card/8
     Hewlett-Packard 27245A EtherTwist PC LAN Adapter Card/8
     Hewlett-Packard 27247A EtherTwist PC LAN Adapter Card/16
     Hewlett-Packard 27248A EtherTwist EISA PC LAN Adapter Card/32
     HP 27247B EtherTwist Adapter Card/16 TP Plus
     HP 27252A EtherTwist Adapter Card/16 TP Plus
     HP J2405A EtherTwist PC LAN Adapter NC/16 TP

   Adapters based upon the TROPIC chipset generally do not support
   promiscuous mode. The TROPIC chipset is used in IBM's Token Ring
   adapters such as the 16/4 adapter. Other vendors (notably 3Com) also
   supply TROPIC based adapters. TROPIC-based adapters do accept special
   EPROMs, however, that will allow them to go into promiscuous mode.
   However, when in promiscuous mode, these adapters will spit out a
   "Trace Tool Present" frame.


     _________________________________________________________________

  ACKNOWLEDGEMENTS

   I would like to thank the following people for the contribution to
   this FAQ that has helped to update and shape it:
     * Padgett Peterson ([e-mail])
     * Steven Bellovin ([e-mail])
     * Wietse Venema ([e-mail])
     * Robert D. Graham ([e-mail])
     * Kevin Martinez ([e-mail])
     * Frederick B. Cohen ([e-mail])
     * James Bonfield ([e-mail])
     * Marc Horowitz ([e-mail])
     * Steve Edwards ([e-mail])
     * Andy Poling ([e-mail])
     * Jeff Collyer ([e-mail])
     * Sara Gordon ([e-mail])


     _________________________________________________________________

  COPYRIGHT

This paper is Copyright (c) 1994, 1995
   by Christopher Klaus of Internet Security Systems, Inc.



   Permission is hereby granted to give away free copies electronically.
   You may distribute, transfer, or spread this paper electronically. You
   may not pretend that you wrote it. This copyright notice must be
   maintained in any copy made. If you wish to reprint the whole or any
   part of this paper in any other medium (ie magazines, books, etc)
   excluding electronic medium, please ask the author for permission.

  DISCLAIMER



   The information within this paper may change without notice. Use of
   this information constitutes acceptance for use in an AS IS condition.
   There are NO warranties with regard to this information. In no event
   shall the author be liable for any damages whatsoever arising out of
   or in connection with the use or spread of this information. Any use
   of this information is at the user's own risk.

  ADDRESS OF AUTHOR



   Please send suggestions, updates, and comments to:
    Christopher Klaus <[e-mail]> of Internet Security Systems, Inc.
    <[e-mail]>



  INTERNET SECURITY SYSTEMS, INC.

   Internet Security Systems, Inc, located in Atlanta, Ga., specializes
   in the developement of security scanning software tools. Its flagship
   product, Internet Scanner, is software that learns an organization's
   network and probes every device on that network for security holes. It
   is the most comprehensive "attack simulator" available, checking for
   over 100 security vulnerabilities.