TCP/IP Protocol Vulnerabilities

What it is

Many everyday network protocols were designed for speed and ease of use, not for security.

Because they trust the information they receive, attackers can abuse them. The weakness is in the design, so the fix is usually a control placed around the protocol.

This page looks at seven protocols and, for each one, the typical attack and the typical defence.

How it works

Each protocol has a trusting step that an attacker can fake or flood.

TCP and UDP

TCP sets up a connection with a three step handshake. The client sends a SYN, the server replies with a SYN and ACK, and the client sends an ACK.

In a SYN flood, the attacker sends many SYN packets and never finishes the handshake. The server keeps half open connections waiting until its resources run out, so real users are refused. TCP can also suffer from session hijacking, where an attacker takes over an established connection.

UDP has no handshake and no connection state. That makes it fast, but it is easy to spoof the source address and to use for floods. Attackers can send small requests with a fake source address so that a much larger reply goes to the victim, which is an amplification attack.

HTTP, ARP and ICMP

HTTP carries web traffic with no encryption, so anyone on the path can read it. HTTPS wraps HTTP in TLS to fix this. Web applications can also be attacked through the input they accept, such as in injection attacks, so input must be validated.

ARP maps an IP address to a MAC address on a local network. In ARP poisoning, the attacker sends false ARP replies that link the attacker's MAC address to another host's IP address, often the default gateway. The victim then sends frames to the attacker, which makes a man in the middle position possible.

ICMP is used by ping and for error messages. Attackers use it to find live hosts in a ping sweep, and to flood a target. Many networks allow only the ICMP types they really need.

C:\> arp -a
Interface: 192.168.1.20 --- 0x4
  Internet Address      Physical Address      Type
  192.168.1.1           aa-bb-cc-dd-ee-01     dynamic

If two different IP addresses show the same MAC address in the ARP table, ARP poisoning is a possible cause.

DHCP

DHCP hands out IP addresses, the default gateway and the DNS server to clients. Clients accept the first offer they hear.

• In a rogue DHCP server attack, a fake server gives clients a gateway or DNS server that the attacker controls.
• In DHCP starvation, the attacker requests all the addresses in the pool, so real clients get none.

On Cisco switches the defence is DHCP snooping. It marks ports as trusted or untrusted and only allows DHCP server replies from trusted ports.

Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10
Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# ip dhcp snooping trust

The last two commands mark one port as trusted. Use them on the port that faces the real DHCP server or the uplink toward it.

DNS

DNS turns names such as a website name into IP addresses. It is a favourite target because everything starts with a lookup.

• DNS spoofing or cache poisoning places a false answer in a resolver, so users are sent to a fake site.
• DNS tunnelling hides other data inside DNS queries to sneak it past controls.
• A DNS flood can make the service unavailable.

Defences include DNSSEC, which signs DNS data so that answers can be verified, using trusted resolvers, and monitoring for unusual query patterns.