s07流量内容监控attack

《s07流量内容监控attack》由会员分享，可在线阅读，更多相关《s07流量内容监控attack（46页珍藏版）》请在装配图网上搜索。

1、1网络攻击的检测和预防网络攻击的检测和预防 第七章2目录目录常见网络攻击的检测和预防DoS攻击的防范 3黑客攻击网络的一般过程黑客攻击网络的一般过程信息的收集 利用的公开协议或工具 TraceRoute程序 SNMP协议 DNS服务器 Whois协议 Ping实用程序4黑客攻击网络的一般过程黑客攻击网络的一般过程系统安全弱点的探测 主要探测的方式 自编程序 慢速扫描 体系结构探测 利用公开的工具软件5黑客攻击网络的一般过程黑客攻击网络的一般过程建立模拟环境，进行模拟攻击 根据前面两小点所得的信息 建立一个类似攻击对象的模拟环境 对此模拟目标进行一系列的攻击6黑客攻击网络的一般过程黑客攻击网络的

2、一般过程具体实施网络攻击 根据前几步所获得的信息 结合自身的水平及经验总结相应的攻击方法 等待时机，以备实施真正的网络攻击7协议欺骗攻击及防范协议欺骗攻击及防范源IP地址欺骗攻击 在路由器上的解决方法防止源IP地址欺骗行为的措施 抛弃基于地址的信任策略 使用加密方法 进行包过滤8协议欺骗攻击及防范协议欺骗攻击及防范源路由欺骗攻击防范源路由欺骗攻击的措施 抛弃由外部网进来却声称是内部主机的报文 在路由器上关闭源路由9协议欺骗攻击及防范协议欺骗攻击及防范拒绝服务攻击防止拒绝服务攻击的措施 调整该网段路由器上的配置 强制系统对超时的Syn请求连接数据包复位 缩短超时常数和加长等候队列 在路由器的前端

3、做必要的TCP拦截 关掉可能产生无限序列的服务10拒绝服务攻击拒绝服务攻击用超出被攻击目标处理能力的海量数据包消耗可用系统，带宽资源，致使网络服务瘫痪的一种攻击手段两种使用较频繁的攻击形式 TCP-SYN flood 半开式连接攻击 UDP flood11拒绝服务攻击拒绝服务攻击12拒绝服务攻击拒绝服务攻击UDP flood Udp在网络中的应用 如，DNS解析、realaudio实时音乐、网络管理、联网游戏等 基于udp的攻击种类 如，unix操作系统的echo,chargen.echo服务13拒绝服务攻击拒绝服务攻击Trinoo 是基于UDP flood的攻击软件Trinoo攻击功能的实现

4、 是通过三个模块付诸实施的 攻击守护进程 NS 攻击控制进程 MASTER 客户端 NETCAT，标准TELNET程序等14拒绝服务攻击及防范拒绝服务攻击及防范六个trinoo可用命令 Mtimer Dos Mdie Mping Mdos msize15拒绝服务攻击拒绝服务攻击16拒绝服务攻击拒绝服务攻击攻击的实例:被攻击的目标主机victim IP为:12.23.34.45 ns被植入三台sun的主机里，他们的IP对应关系分别为 client1:11.11.11.11 client2:22.22.22.22 client3:33.33.33.33 master所在主机为masterhost:

5、11.22.33.44 首先我们要启动各个进程，在client1，2，3上分别执行ns，启动攻击守护进程，其次，在master所在主机启动master masterhost#./master?gOrave(系统示输入密码，输入gOrave后master成功启动)trinoo v1.07d2+f3+c Mar 20 2000:14:38:49(连接成功)17拒绝服务攻击拒绝服务攻击在任意一台与网络连通的可使用telnet的设备上，执行 telnet 11.22.33.44 27665 Escape character is.betaalmostdone(输入密码)trinoo v1.07d2+f

6、3+c.rpm8d/cb4Sx/trinoo(进入提示符)trinoo mping(我们首先来监测一下各个攻击守护进程是否成功启动)mping:Sending a PING to every Bcasts.trinoo PONG 1 Received from 11.11.11.11 PONG 2 Received from 22.22.22.22 PONG 3 Received from 33.33.33.33(成功响应)trinoo mtimer 60(设定攻击时间为60秒)mtimer:Setting timer on bcast to 60.trinoo dos 12.23.34.45

7、 DoS:Packeting 12.23.34.45.18拒绝服务攻击拒绝服务攻击至此一次攻击结束，此时ping 12.23.34.45，会得到icmp不可到达反馈，目标主机此时与网络的正常连接已被破坏 19拒绝服务攻击拒绝服务攻击由于目前版本的trinoo尚未采用IP地址欺骗，因此在被攻击的主机系统日志里我们可以看到如下纪录 Mar 20 14:40:34 victim snmpXdmid:Will attempt to re-establish connection.Mar 20 14:40:35 victim snmpdx:error while receiving a pdu from

8、 11.11.11.11.59841:The message has a wrong header type(0 x0)Mar 20 14:40:35 victim snmpdx:error while receiving a pdu from 22.22.22.22.43661:The message has a wrong header type(0 x0)Mar 20 14:40:36 victim snmpdx:error while receiving a pdu from 33.33.33.33.40183:The message has a wrong header type(0

9、 x0)Mar 20 14:40:36 victim snmpXdmid:Error receiving PDU The message has a wrong header type(0 x0).Mar 20 14:40:36 victim snmpXdmid:Error receiving packet from agent;rc=-1.Mar 20 14:40:36 victim snmpXdmid:Will attempt to re-establish connection.Mar 20 14:40:36 victim snmpXdmid:Error receiving PDU Th

10、e message has a wrong header type(0 x0).Mar 20 14:40:36 victim snmpXdmid:Error receiving packet from agent;rc=-1.20拒绝服务攻击防范拒绝服务攻击防范检测系统是否被植入了攻击守护程序办法 检测上述提到的udp端口 如netstat-a|grep udp 端口号 用专门的检测软件21拒绝服务攻击及防范拒绝服务攻击及防范下面为在一台可疑设备运行结果，Logging output to:LOG Scanning running processes./proc/795/object/a.ou

11、t:trinoo daemon /usr/bin/gcore:core.795 dumped /proc/800/object/a.out:trinoo master /usr/bin/gcore:core.800 dumped Scanning/tmp.Scanning/./yiming/tfn2k/td:tfn2k daemon /yiming/tfn2k/tfn:tfn2k client /yiming/trinoo/daemon/ns:trinoo daemon /yiming/trinoo/master/master:trinoo master /yiming/trinoo/mast

12、er/.:possible IP list file NOTE:This message is based on the filename being suspicious,and is not based on an analysis of the file contents.It is up to you to examine the file and decide whether it is actually an IP list file related to a DDOS tool./yiming/stacheldrahtV4/leaf/td:stacheldraht daemon

13、/yiming/stacheldrahtV4/telnetc/client:stacheldraht client /yiming/stacheldrahtV4/td:stacheldraht daemon /yiming/stacheldrahtV4/client:stacheldraht client /yiming/stacheldrahtV4/mserv:stacheldraht master ALERT:One or more DDOS tools were found on your system.Please examine LOG and take appropriate ac

14、tion.22拒绝服务攻击防范拒绝服务攻击防范封掉不必要的UDP服务 如echo,chargen,减少udp攻击的入口 23拒绝服务攻击防范拒绝服务攻击防范路由器阻挡一部分ip spoof,syn攻击 通过连接骨干网络的端口 采用CEF和ip verify unicast reverse-path 使用access control lists 将可能被使用的网络保留地址封掉 使用CAR技术 限制 ICMP 报文大小24Specific Attack TypesAll of the following can be used to compromise your system:Packet sn

15、iffers IP weaknesses Password attacks DoS or DDoS Man-in-the-middle attacks Application layer attacks Trust exploitation Port redirection Virus and worms Trojan horse Operator error25IP SpoofingIP spoofing occurs when a hacker inside or outside a network impersonates the conversations of a trusted c

16、omputer.Two general techniques are used during IP spoofing:A hacker uses an IP address that is within the range of trusted IP addresses.A hacker uses an authorized external IP address that is trusted.Uses for IP spoofing include the following:IP spoofing is usually limited to the injection of malici

17、ous data or commands into an existing stream of data.A hacker changes the routing tables to point to the spoofed IP address,then the hacker can receive all the network packets that are addressed to the spoofed address and reply just as any trusted user can.26IP Spoofing MitigationThe threat of IP sp

18、oofing can be reduced,but not eliminated,through the following measures:Access controlThe most common method for preventing IP spoofing is to properly configure access control.RFC 2827 filteringYou can prevent users of your network from spoofing other networks(and be a good Internet citizen at the s

19、ame time)by preventing any outbound traffic on your network that does not have a source address in your organizations own IP range.Additional authentication that does not use IP-based authenticationExamples of this include the following:Cryptographic(recommended)Strong,two-factor,one-time passwords2

20、7Application Layer AttacksApplication layer attacks have the following characteristics:Exploit well known weaknesses,such as protocols,that are intrinsic to an application or system(for example,sendmail,HTTP,and FTP)Often use ports that are allowed through a firewall(for example,TCP port 80 used in

21、an attack against a web server behind a firewall)Can never be completely eliminated,because new vulnerabilities are always being discovered28Application LayerAttacksMitigationSome measures you can take to reduce your risks are as follows:Read operating system and network log files,or have them analy

22、zed by log analysis applications.Subscribe to mailing lists that publicize vulnerabilities.Keep your operating system and applications current with the latest patches.IDSs can scan for known attacks,monitor and log attacks,and in some cases,prevent attacks.29Network ReconnaissanceNetwork reconnaissa

23、nce refers to the overall act of learning information about a target network by using publicly available information and applications.30Network Reconnaissance Mitigation Network reconnaissance cannot be prevented entirely.IDSs at the network and host levels can usually notify an administrator when a

24、 reconnaissance gathering attack(for example,ping sweeps and port scans)is under way.31Virus and Trojan HorsesViruses refer to malicious software that are attached to another program to execute a particular unwanted function on a users workstation.End-user workstations are the primary targets.A Troj

25、an horse is different only in that the entire application was written to look like something else,when in fact it is an attack tool.A Trojan horse is mitigated by antivirus software at the user level and possibly the network level.32DOS/DDOSDOS 拒绝服务攻击DDOS 分布式拒绝服务攻击利用TCP/IP缺陷33常见常见DOS工具工具Bonk通过发送大量伪造

26、的UDP数据包导致系统重启动 TearDrop通过发送重叠的IP碎片导致系统的TCP/IP栈崩溃 SynFlood通过发送大量伪造源IP的基于SYN的TCP请求导致系统重启动 Bloop 通过发送大量的ICMP数据包导致系统变慢甚至凝固 Jolt 通过大量伪造的ICMP和UDP导致系统变的非常慢甚至重新启动 34SynFlood原理原理Syn 伪造源地址(1.1.1.1)IP:211.100.23.11.1.1.1(TCP连接无法建立，造成TCP等待超时）Ack 大量的伪造数据包发向服务器端35DDOS攻击攻击黑客控制了多台服务器，然后每一台服务器都集中向一台服务器进行DOS攻击36DDOS攻

27、击示意图攻击示意图37分布式拒绝服务攻击分布式拒绝服务攻击38分布式拒绝服务攻击步骤分布式拒绝服务攻击步骤1ScanningProgram不安全的计算机不安全的计算机Hacker攻击者使用扫描攻击者使用扫描工具探测扫描大工具探测扫描大量主机以寻找潜量主机以寻找潜在入侵目标。在入侵目标。1Internet39分布式拒绝服务攻击步骤分布式拒绝服务攻击步骤2Hacker被控制的计算机被控制的计算机(代理端代理端)黑客设法入侵有安全漏洞黑客设法入侵有安全漏洞的主机并获取控制权。这的主机并获取控制权。这些主机将被用于放置后门、些主机将被用于放置后门、sniffer或守护程序甚至是或守护程序甚至是客户程序

28、。客户程序。2Internet40分布式拒绝服务攻击步骤分布式拒绝服务攻击步骤3Hacker 黑客黑客在得到入侵计算机在得到入侵计算机清单后，从中选出满足建清单后，从中选出满足建立网络所需要的主机，放立网络所需要的主机，放置已编译好的守护程序，置已编译好的守护程序，并对被并对被控制的计算机发送控制的计算机发送命令。命令。3被控制计算机（代理端）被控制计算机（代理端）MasterServerInternet41HackerUsing Client program,黑客发送控制命令给主机，黑客发送控制命令给主机，准备启动对目标系统的攻击准备启动对目标系统的攻击4被控制计算机（代理端）被控制计算机（

29、代理端）TargetedSystemMasterServerInternet分布式拒绝服务攻击步骤分布式拒绝服务攻击步骤442Targeted SystemHacker 主机发送攻击信号给被控主机发送攻击信号给被控制计算机开始对目标系统制计算机开始对目标系统发起攻击发起攻击。5MasterServerInternet被控制计算机（代理端）被控制计算机（代理端）分布式拒绝服务攻击步骤分布式拒绝服务攻击步骤543分布式拒绝服务攻击步骤分布式拒绝服务攻击步骤6TargetedSystemHacker 目标系统被无数的伪目标系统被无数的伪造的请求所淹没，从而无造的请求所淹没，从而无法对合法用户进行响应，法对合法用户进行响应，DDOS攻击成功。攻击成功。6MasterServerUserRequest DeniedInternet被控制计算机（代理端）被控制计算机（代理端）44分布式拒绝服务攻击的效果分布式拒绝服务攻击的效果整个过程是自动化的攻击者能够在5秒钟内入侵一台主机并安装攻击工具 也就是说，在短短的一小时内可以入侵数千台主机并使某一台主机可能要遭受1000MB/S数据量的猛烈攻击 这一数据量相当于1.04亿人同时拨打某公司的一部电话号码45BGP 网络网络DDOS攻击的解决案例攻击的解决案例实验演示。（一定程度保密协议的案例）若有不当之处，请指正，谢谢！若有不当之处，请指正，谢谢！