Hacker intrusion plan

1. Data-driven attacks

Data-driven attacks may occur when some seemingly harmless special programs are sent or copied to the network host and attacked. For example, a data-driven attack can cause a host to modify files related to network security, making it easier for hackers to intrude into the system for the next time.

2. theft and illegal use of system files

Directory of executable files in Unix systems, such as/bin/WHO, which can be read and accessed by all users. Some users can obtain the version number from the executable file to learn about the system's vulnerabilities based on published information. For example, they can use Telnet commands to know the version number of Sendmail. Prohibit Access to executable files. Although it cannot prevent hackers from attacking them, it can at least make this attack more difficult. Some other vulnerabilities are caused by configuration files, access control files, and default initialization files. One of the most famous examples is the software used to install SunOS version 4, which creates a/rhosts file that allows anyone on the LAN (Internet, obtain super user privileges on the host from anywhere. Of course, the initial setting of this file is to facilitate installation from the Internet without the permission and check of the Super User. The wise man is always worried about it. The operating system design vulnerability opens a backdoor for hackers, and a series of specific attacks against Win95/Win NT are good examples.

3. out of nothing, counterfeit information attack

By sending forged routing information, construct a false path between the system source host and the target host, so that data packets flowing to the target host are transmitted through the attacker's system host. In this way, sensitive information and useful passwords are provided.

4. underwrite Chen Cang for Information Protocol Vulnerability attacks

The Source Path option of the IP address allows the IP packet to select a path to the target host of the system. Imagine an attacker trying to connect to a remote host a behind the firewall. He only needs to set the IP Source Path option in the sent request message so that the packet has a destination address pointing to the firewall, and the final address is host. The packet is allowed to pass when it reaches the firewall because it points to the firewall rather than host. The IP layer of the firewall changes the Source Path of the packet and sends the packet to the Intranet. As a result, the packet reaches the inaccessible host.

5. support remote operation

The default logon interface (shell scripts), configuration, and customer files are another issue area. They provide a simple way to configure the execution environment of a program. This sometimes causes remote control attacks: an executable program is started on the attacked host, which displays a forged logon interface. After a user enters the login information (username, password, etc.) on this disguised interface, the program transmits the information entered by the user to the attacker's host, then, the system fault prompt is displayed, asking the user to log on again. The real logon interface will appear later. Similar attacks will continue until we can get a new and more sophisticated operating system version. An important role of the firewall is to prevent illegal users from logging on to the host of the protected network. For example, you can disable telnet logon from an external host to an internal host during packet filtering.

6. Take advantage of System Administrator errors

One of the important factors in network security is people! Countless historical facts show that security protection is the easiest way to break through the attack. Therefore, human errors, such as configuration errors in the WWW server system, can be exploited by normal users to increase user permissions. Hackers often use System Administrator errors to collect attack information. Such as using commands such as finger, netstat, ARP, mail, grep, and some hacker tools.

7. Send a message again

Collect specific IP data packets, tamper with the data, and resend the packets one by one to spoof the received host.

8. migrate the tiger from the mountains to the west

Although it is difficult to attack ICMP packets, hackers sometimes use ICMP packets for attacks. The redirection message can change the route list. The router can recommend that the host go to another better path based on these messages. Attackers can effectively use redirection messages to redirect connections to an unreliable host or path, or forward all packets through an unreliable host. The solution to this problem is to filter all ICMP redirection packets, which can be configured by some routing software. It is not advisable to simply discard all redirection packets: hosts and routers often use them, such as when a router fails.

9. Attack on Source Path Options

The message is forcibly sent to the target host through a specific path. Such packets can be used to attack firewalls and cheat hosts. An external attacker can send a source path packet with an internal host address. The server will trust this packet and send an answer packet to the attacker, because this is the source path option requirement of the IP address. The best way to deal with such attacks is to configure a router so that it can discard packets that come in from an external network but claim to be internal hosts.

10. network broadcast attacks

Set the Ethernet interface to promiscuous to intercept all data packets in a local range for my use.

11. Distance and distance attacks

Many websites on the Internet now use UNIX operating systems. Hackers will first try to log on to a unix host, gain system privileges through this operating system vulnerability, and then access other hosts from this base, this is called island-hopping ).

Hackers often do this several times before reaching the target host. For example, a U.S. hacker may log on to a host in Asia, log on to a host in Canada, and then jump to Europe before entering the FBI's network, finally, an attack was initiated from a French host to the FBI. In this way, even if a hacker finds out where the hacker initiated an attack, it is difficult for the Administrator to retrieve the attack. What's more, after the hacker obtains the system privileges of a host, you can delete system logs when you exit and cut the "Teng. As long as you can log on to a UNIX system, you can easily become a super user, which makes it a concern for hackers and security experts at the same time.

12. Steal the bar and steal TCP connections

Network Interconnection protocols are also vulnerable to attacks. In addition, the interconnection protocols were originally generated to facilitate information exchange. Therefore, designers seldom or even ignore security considerations. The analysis of security protocols has become the most harmful measure of attacks.

There is a long-known vulnerability in almost all UNIX-implemented protocol families, which makes it possible to steal TCP connections. When a TCP connection is being established, the server uses a response message containing the initial serial number to confirm the user request. This serial number has no special requirements, as long as it is unique. After receiving the answer, the client confirms it again and the connection is established. The TCP protocol specification requires that the serial number be changed 0.25 million times per second. However, the actual replacement frequency of most Unix systems is much smaller than this quantity, and the next replacement number is often predictable. Hackers have the ability to predict the initial serial number of the server so that the attack can be completed. The only way to prevent such attacks is to make the generation of initial serial numbers more random. The safest solution is to use an encryption algorithm to generate an initial serial number. The extra CPU computing load can be ignored for the current hardware speed.

13. Take control of the system based on anti-customer

In Unix systems, too many files can only be owned by super users, but few can be owned by a certain type of users. This allows the Administrator to perform various operations under root, this approach is not safe. Root is the primary target of hacker attacks, and the most common target of attacks is the superuser password. Strictly speaking, the user password in UNIX is not encrypted. It is only used as the DES algorithm to encrypt the key of a commonly used string. There are now a lot of software tools for decryption, they use the high speed of the CPU to search for passwords. Once the attack succeeds, hackers will become Emperors in UNIX systems. Therefore, the system's rights are separated by three powers. If the mail system administrator is set to manage, the mail system administrator can manage the mail system well without the superuser privilege, this makes the system much safer.

In addition, after attackers break the system, they often use the golden shell to delete system operation logs, so that they are not discovered by the system administrator, and then make another comeback. As a result, cyber attackers use all possible methods to attack the target system. This is the so-called 36-Year Plan.