Computer Communications 22 (1999) 885–897

Review

TCP/IP security threats and attack methods

B. Harris a, R. Hunt b,*
a
Enterprise Risk Services, Deloitte Touche Tohmatsu, Wellington, New Zealand
b
Department of Computer Science, University of Canterbury, Private Bag 4800, Christchurch, New Zealand
Received 29 June 1998; received in revised form 2 February 1999; accepted 2 February 1999

Abstract
The TCP/IP protocol suite is vulnerable to a variety of attacks ranging from password sniffing to denial of service. Software to carry out
most of these attacks is freely available on the Internet. These vulnerabilities—unless carefully controlled—can place the use of the Internet
or intranet at considerable risk. This article classifies a range of known attack methods focusing in particular on SYN flooding, IP spoofing,
TCP sequence number attack, TCP session hijacking, RST and FIN attacks and the Ping O’ Death. The article concludes with an examination
of the vulnerabilities of the common protocols carried by TCP/IP (including SMTP, Telnet, NTP, Finger, NFS, FTP, WWW and X windows)
and proposes configuration methods to limit their vulnerability. q 1999 Elsevier Science B.V. All rights reserved.
Keywords: SYN flooding; IP spoofing; TCP sequence number attack; TCP session hijacking; Ping O’ Death; TCP/IP service threats

1. Introduction diverse array of serious attacks. For example, 44%

reported unauthorised access by employees, 25%
The 1998 Computer Crime and Security Survey [1] reported denial of service attacks, 24% reported system
conducted by the Computer Security Institute (CSI) and penetration from the outside, 18% reported theft of
Federal Bureau of Investigation (FBI) reports a continuing proprietary information, 15% reported incidents of finan-
growth in US computer crime. The survey received cial fraud, and 14% reported sabotage of data or
responses from 520 security practitioners covering a networks.
cross-section of US corporations, government agencies, • The most serious financial losses occurred through
financial institutions and universities. The following points unauthorised access by insiders (18 respondents reported
summarise a number of the most interesting results: a total of US$50 565 000 in losses), theft of proprietary
information (20 respondents reported a total of
• 64% of respondents reported computer security breaches
US$33 545 000 in losses), telecommunications fraud
in the twelve months prior to March 1998. This figure
(32 respondents reported a total of US$17 256 000 in
represents an increase of 16% over the “1997 CSI/FBI
losses) and financial fraud (29 respondents reported a
Computer Crime and Security Survey” results, in which
total of US$11 239 000 in losses).
48% of respondents reported unauthorised use. The 1998
• The number of organisations that cited their Internet
survey represents a 22% over the initial 1996 survey, in
connection as a frequent point of attack rose from 47%
which 42% acknowledged unauthorised use.
in 1997 to 54% in 1998. This represents a 17% increase
• Although 72% of respondents acknowledge suffering
over the initial 1996 figure of 37%. Significantly, the
financial losses from such security breaches, only 46%
number of respondents citing their Internet connection
were able to quantify their losses. The total financial
as a frequent point of attack is now equal to the number
losses for the 241 organisations that could put a dollar
of respondents citing internal systems as a frequent point
figure on them adds up to US$136 822 000. This figure
of attack. In the past, internal systems have been consid-
represents a 36% increase in reported losses over the
ered the greatest threat, however, it is not the internal
1997 figure of US$100 115 555.
threat that has diminished, but simply that the threat
• Security breaches detected by respondents include a
from outside, e.g. Internet connections, has increased.
Although these statistics are helpful when analysing
* Corresponding author. Tel.: 1 64-3-3642347; fax: 1 64-3-3642999.
E-mail addresses: [email protected] (B. Harris); [email protected] attack trends and for determining where threats lie, they
bury.ac.nz (R. Hunt) do not provide an understanding of the attacks themselves.
0140-3664/99/$ - see front matter q 1999 Elsevier Science B.V. All rights reserved.
PII: S0140-366 4(99)00064-X
886 B. Harris, R. Hunt / Computer Communications 22 (1999) 885–897

It is essential that attack methods are understood, especially • Information Theft: Using knowledge of certain Internet
when developing security policies and procedures that services, such as NFS, hackers can spoof the host authen-
address the right problems in the most effective and efficient tication mechanism to gain access to sensitive informa-
ways. tion. If a hacker has access to a valid password, then
The following points introduce a few of the most depending on the level of access it provides, sensitive
common attacks [2] used by both internal and external organisational information and data may be at risk.
attackers: Computer Weekly reported findings by the CSI which
indicated that information theft rose 260% from 1985
• Password Guessing: It is relatively easy to obtain a pass-
to 1993. Of 8932 attacks, 7860 were successful, but
word cracking program such as “Crack”. 2 These
only 19 were reported [4]. A properly configured firewall
programs use standard and non standard dictionaries,
can help prevent unauthorised access by providing coun-
and simply try to guess an account’s password. Usually,
termeasures such as strong authentication or network
such programs find at least 10% of the passwords chosen
encryption.
by users [2]. Educating users as to the correct selection
• Denial of Service: This is a class of attack designed to
and use of passwords is the most effective solution.
prevent the use of computers and networks by legitimate
• Password Sniffing: The Computer Emergency Response
users. Some attacks, such as “Ping O’ Death”, can
Team (CERT) Co-ordination Centre estimates that in
completely shut down or disable equipment and services.
1994 more than 100 000 systems were the victim of pass-
For example, it is possible to send ICMP redirect
word sniffers. These programs are usually placed once a
messages to a host or router telling it to stop sending
hacker gains entry to a system. The programs monitor all
IP datagrams to all or part of a network. More common
IP traffic, gathering the first 128 or so bytes of every
are flooding attacks, e.g. SYN flooding, which overloads
Telnet or FTP session. The best defence is to employ
a computer or network so that it spends all of its time
one-time password schemes.
responding to illegitimate messages and requests. Solu-
• IP Spoofing: There are a number of IP spoofing attacks
tions include placing services on separate hosts so if one
which take advantage of the information contained
is flooded the others will continue to function, or using a
within the IP packet header. For example the Christmas
properly configured firewall to filter out dangerous proto-
Day attack on Tsutomu Shimomura 3 involved forging
cols, such as ICMP redirect messages.
the source address of the IP packets so they looked as
• Information Destruction: In some cases an attacker’s
if they were generated from within Shimomura’s
intentions may be purely malicious where the aim of
network. Another IP attack involves loose source routing
their attack is the destruction of an organisation’s infor-
of IP packets. The attacker manipulates the IP header’s
mation. Related to this is unauthorised data modification,
source routing option to change the path the packets
for example an attacker may wish to confuse experimen-
should take. Properly configured firewalls capable of
tal results, or alter the number of units sent to a customer.
packet filtering provide the best means of defence against
Obviously, the reasons behind such attacks are complex-
these types of attacks [3].
they may be driven by revenge, corporate rivalry, or just
Some attacks such as password sniffing and IP spoofing plain delinquency. It is easy to think of many situations
are much easier for an attacker who is internal to the orga- in which an organisation could suffer such attacks.
nisation as these attacks require access to the IP datagrams.
The following sections look at the vulnerabilities
It is difficult (even impossible) to do this on the Internet
exploited by attackers, and focuses on the TCP/IP protocol,
unless the attacker controls a routing node. Although these
and on the applications that it underlies.
attacks are only practical due to the presence of a vulner-
ability, it is important to consider the reasons behind their
launch so that risks can be fully understood. The following 2. Threats to the TCP/IP protocol
points describe a few of the reasons an attack may be
conducted: This section describes a number of common attacks
which exploit the limitations and inherent vulnerabilities
2
in the TCP and IP protocols.
“CRACK” is available at ftp://ftp.cert.org/pub/tools/crack.
3
On Christmas Day, 1994, a hacker launched a sophisticated “IP spoof- • SYN flooding
ing” attack against the home computer of a computer security expert, • IP Spoofing
Tsutomu Shimomura, a researcher at the federally financed San Diego • Sequence number attack
Supercomputer Center in California. Over a two week period Shimomura
pursued and eventually tracked the hacker to computers on which Shimo-
• TCP session hijacking
mura’s stolen files were found. The hacker was finally identified as federal • RST and FIN denial of service attack
fugitive Kevin Mitnick, and subsequently arrested on February 15, 1995 by • Ping O’ Death
FBI agents. The following WWW-addresses provide links to a great deal of
interesting information regarding the Christmas Day attack and Kevin These attacks were chosen because software to launch
Mitnick; http://www.gulker.com/ra/hack/ and http://www.mitnick.com/. them (including source code) is freely available on the
 B. Harris, R. Hunt / Computer Communications 22 (1999) 885–897 887

Obviously, this queue must be bounded otherwise an

attacker could make unlimited connection requests to a
TCP port and consume all of the server’s memory
resources—which in itself would constitute a denial-of-
service attack!
The attacking host must ensure that the source IP-address
is spoofed to be that of a routable but unreachable host, as
the target host will be sending its response to this address. IP
(by way of ICMP) will inform TCP that the host is unreach-
able, however, TCP considers these errors to be transient
and leaves their resolution up to IP (reroute the packets,
etc)—in effect ignoring them. The IP destination address
must be unreachable because the attacker does not want any
host to receive the SYN/ACKs sent by the target host, as this
would elicit an RST from that host and defeat the attack.
Fig. 1 shows the steps involved in launching a TCP SYN
Fig. 1. TCP SYN flood attack. flood attack. To begin (step 1) the attacking host sends a
multitude of SYN requests to the target to fill its backlog
Internet. They are also the most common and practical queue with pending connections. Once the target receives
attacks used by attackers on the inside and outside of this request it responds with SYN/ACKs (step 2) to what it
organisations networks. believes is the source of the incoming SYNs. Once the back-
log queue is full all further requests to the TCP port will be
ignored until the original requests begin to time out and
2.1. SYN flooding
reset—normally after 75 s. After each time out (step 3)
2.1.1. Description the server port sends a RST to the unreachable client. At
SYN flooding occurs when a server receives more incom- this point the attacker must repeat the process again (from
plete connection requests than it can handle [5]. In 1996 step 1) to maintain the denial-of-service attack.
both 2600 4 and Phrack 5, two of the largest and most well- To make this attack more difficult to detect and respond
known of the underground hacker magazines, released to, the software randomises the source address of the IP
source code that automated this attack. packets sent by the attacking host. Thus, the target host
Under normal conditions hosts that wish to exchange data receives packets that appear to be from all over the Internet,
over a TCP connection must initiate the session using a 3 assuring the attackers anonymity.
step process known as the 3-way handshake. The SYN flood
attack is based on preventing the completion of the 3-way 2.1.2. Countermeasure
handshake—in particular the server’s reception of the TCP There are several ways of reducing the effectiveness of
ACK flag. the SYN flood attack. The first relies on ISPs being respon-
Unlike a normal TCP connection request, the SYN flood sible enough to block IP packets with non-internal addresses
attack withholds the final ACK packet which leaves a from leaving their network and reaching the Internet. There-
server’s port in a half-open state. The attack succeeds fore, an attacker would have to send packets with an official
because the number of half-open connections that can be IP source address which in most cases would lead back
supported per TCP port is limited. When the number of half- (through audit logs) to the owner of the account that the
open connections is exceeded the server will reject all attack was being launched from. This lack of anonymity
subsequent incoming connection requests until the existing would deter most attackers, although skilled and determined
requests time out, usually after 75 s creating a denial-of- attackers would use accounts that had been compromised or
service condition. they could launch attacks through sites that do not regulate
To initiate the SYN flood attack, the attacking host sends Internet traffic.
a number of SYN requests to the target TCP port (e.g. the Other preventative methods require changes to the
Telnet daemon) to fill up its concurrent connection request network aspects of the operating system, or the addition of
(or backlog) queue—the exact number depends upon the intrusion detection tools. For example a list of connection
operating system (see [6]). This allows a server (i.e. listen- requests could be kept with details of their source address,
ing port) to queue concurrent connection requests for later TTL (Time to Live), sequence numbers, windows size etc.
processing. To achieve this the details of each pending These variables could then be analysed for suspicious activ-
connection request are stored in a memory structure. ity, which, if detected, would result in an RST being sent to
allow new connections to be made. Other solutions rely on
4
The 2600 WWW-site is available at http://www.2600.com/. increasing the size of the backlog queue and randomly drop-
5
The Phrack WWW-site is available at http://www.phrack.com/. ping half-open connection requests when the queue is full.
888 B. Harris, R. Hunt / Computer Communications 22 (1999) 885–897

2.2.2. TCP sequence number prediction

TCP sequence number prediction is used by attackers to
attack TCP sessions, and takes advantage of the fact that
TCP is a sequenced data delivery protocol. TCP segments
are encapsulated within IP datagrams, and as a result there is
no guarantee that the datagrams will follow the same route
and therefore arrive in the order they were sent. Also
network errors may require datagrams to be resent. The
TCP protocol uses sequence numbers to ensure that the
application layer receives data in the same order that it
was sent. Although this is a simple and effective method
of ensuring a sequenced data stream, it unfortunately intro-
Fig. 2. TCP 3-way handshake and data transfer.
duces a vulnerability. If an attacker can guess the correct
sequence number they can then generate their own TCP
2.2. IP spoofing, TCP sequence number prediction, and TCP segments that will be accepted by the target host’s TCP
session hijack layer.
There are really two variations on this attack depending
2.2.1. IP spoofing upon how early the TCP session is attacked. Fig. 2 shows the
IP spoofing is an attack in which the attacker imperso- three steps of a normal the TCP 3-way handshake, if
nates a host (or a legitimate user) at the IP layer. In most successful both the client and server proceed to step 4 and
cases the objective is to attack the trust-relationship between can exchange data. The attacker can choose to attack the
two hosts, this relationship depends upon the source IP TCP handshake to take advantage of a trust relationship—
address to correctly authenticate a host. The attack is only often referred to as IP spoofing but to avoid ambiguity will
possible if the target host has a trust-relationship with at be known here as TCP spoofing. Alternatively the attacker
least one other host. The most popular trust-relationship is can wait until step 4 to take over a legitimate TCP session—
provided by the .rhosts file found on Unix operating referred to as TCP session hijacking. Full technical discus-
systems, although many others exist, e.g. the Unix files sions regarding TCP sequence number prediction and TCP
hosts.allow, hosts.equiv, etc. The .rhosts file allows a user session hijacking can be found in [7–10].
to build a set of trusted hosts applicable only to themselves. There are two ways to carry out TCP spoofing attacks;
For example, suppose that the t ray/.rhosts file on the host • Non-Blind Spoofing: In this case the attacker is on the
huia.canterbury.ac.nz contained the lines: same network path as the spoofed and target hosts (e.g.
kaka.canterbury.ac.nz Ethernet 10Base-T LAN) and has direct access to the IP
matata.canterbury.ac.nz datagrams which contain the TCP segments. Therefore,
sequence number prediction is trivial because the
This .rhosts file would allow an account named ray on attacker simply uses a protocol analyser to capture the
kaka or on matata to rlogin into ray’s account on huia with- TCP segments and obtain the required sequence number.
out typing a password! • Blind Spoofing: Is more difficult because the attacker is
In itself IP spoofing is quite simple, all the attacker has to not on the same network path as the spoofed and target
do is generate an IP datagram with a forged source address. hosts, therefore direct access to the IP datagrams and
This is done by creating an IP datagram from scratch using TCP segments is not possible. Instead the attacker must
RAW-Sockets. 6 The target host has no way of determining attempt to guess the correct initial TCP sequence
that an IP datagram has been spoofed, all it has to rely on is number, the success of which depends upon the mechan-
the IP source address. On its own, IP spoofing is mostly ism being used to generate it. There are three mechan-
limited to providing anonymity for an attacker launching isms in common use:
attacks against the IP layer, e.g. SYN flooding, ICMP redir-
ects, ping flooding, etc. Therefore, to complete the attack • 64K rule: this is the simplest mechanism and surpris-
against trust-relationships described above, the attacker ingly is still used, or can be found on hosts running
must combine IP spoofing with TCP sequence number older operating systems (e.g. OSF, SunOS). Most
prediction—this provides the attacker with a delivery spoofing programs still provide support to take advan-
mechanism for sending application data to the target host. tage of this rule. The rule is implemented as follows:
increase the initial sequence counter every second
with a constant (normally 128 000).
6
The term “Raw-Sockets” refers to the ability in 4.2BSD derived socket if there is a connection initiated, increase the sequence
implementations to access the network layer instead of the transport layer. counter with another constant (normally 64 000).
For example, the programmer could directly format the fields within the IP
datagram to generate ICMP echo requests (i.e. Ping). Obviously, such a mechanism is very easy to
 B. Harris, R. Hunt / Computer Communications 22 (1999) 885–897 889

Fig. 3. Example of a blind spoofing attack.

predict, especially as the sequence counter is only In both cases the attacker must ensure that the spoofed
altered once per second—a very large period in host is unreachable, otherwise it will receive a SYN/ACK
network time! (see step 2 in Fig. 2) from the target host in response to the
• time related generation: is a very popular and simple attacker’s spoofed connection request. However, the
mechanism which allows the sequence number spoofed host has no knowledge of initiating a connection
generator to generate time dependant values. The request and will send an RST to the target host which will
number generator is seeded at boot time, and is abort the connection and defeat the attack. The attacker
increased on a regular basis (e.g. ms) by an x number normally has two options to deal with this problem, either
of time-units. Note that time-units on computers are to wait until the spoofed host is unreachable because of
not necessarily perfect, nor are all time-units of equal maintenance, or take it off-line with a denial-of-service
length, depending on how they are measured and on attack such as a SYN flood. Fig. 3 depicts a blind spoofing
the load of the computer, etc. This variability attack.
increases the difficulty of predicting a correct From the attacker’s perspective blind spoofing is difficult
sequence number. because all replies from the target host are sent to the
• pseudo-random generation: in an effort to foil the spoofed host. Therefore, the attacker cannot determine
prediction of initial sequence numbers newer operat- directly the success or failure of their attack. However,
ing systems are using pseudo-random number genera- there are ways for attackers to turn a blind spoof into a
tors to generate the values—which makes prediction non-blind spoof. This is achieved by using source routed
nearly impossible. IP datagrams [11], or by directly effecting the routing tables
890 B. Harris, R. Hunt / Computer Communications 22 (1999) 885–897

Fig. 4. Example of a TCP session hijack.

of intermediary gateways and routers. Source routing 7 is a sensibly to the routing information they receive. In most
feature (an option) of the IP protocol which allows the cases though the Internet routes are stable enough so that
sender to specify a route for an IP datagram to follow. all routing packets can be ignored.
The route is recorded in the IP header and the receiver
uses the reverse of this to send replies. Therefore, an 2.2.3. TCP session hijacking
attacker could send source routed IP datagrams appearing The final attack, based on IP spoofing and TCP sequence
to come from the spoofed host and including a route that number prediction, is TCP session hijacking which can be
sends replies back past the attacker. This is one reason why carried out against any TCP based application, e.g. Telnet,
it is important to drop source routed IP datagrams, espe- rlogin, FTP, etc. The only requirement is that the attacker
cially those originating from untrusted networks. has access to the IP datagrams sent between the target and
In addition to source routing, it is also possible to change spoofed hosts as this is necessary to obtain the correct
the routing tables of gateways and routers by sending sequence number. Once the attacker has a sequence number,
spoofed routing packets using protocols, such as, RIP, a TCP segment can be sent, effectively taking over the
BGP4, etc. As with source routed IP datagrams it is impor- connection—all further packets sent by the spoofed host
tant to ensure that gateways and routers ignore or respond will be ignored by the target host because the sequence
numbers will be incorrect. An example of TCP session
hijacking is shown in Fig. 4.
7
Source routing allows the sender to specify the route of an IP datagram. Generally, TCP hijacking is used to take over a Telnet
Two forms are provided; strict and loose source routing. Strict source session. Telnet is a particularly easy protocol to hijack
routing allows the sender to specify the exact path that the IP datagram
must follow. Loose source routing allows the sender to specify a list of IP
because it simply passes a stream of bytes between the client
addresses that the datagram must traverse, but the datagram can also pass and the server. All the attacker has to do is to insert their
through other routers between any two addresses in the list. commands (as a sequence of bytes) into the spoofed TCP
 B. Harris, R. Hunt / Computer Communications 22 (1999) 885–897 891

data segments. The server will reassemble the TCP anonymous FTP session! However, providing remote FTP
segments into command strings which will then be executed access across the Internet to the superuser for uncontrolled
as though the legitimate user had typed them. The only read and write access has far greater implications. In such a
evidence of this attack is that the legitimate user’s Telnet case both strong authentication and cryptography are
session hangs because it never receives conformation of the required, because the risk to the operating system by allow-
segments it sends, and will simply continue to resend them. ing such a connection would be too high.
After a few seconds the user will probably attribute the It is essential to understand the possible threats and
inactivity to “Murphy’s Law” and begin a new session. vulnerabilities introduced by connecting to untrusted
TCP session hijacking has a number of benefits over other networks so that the risks can be accurately assessed. It is
attacks, such as sniffing IP datagrams for passwords, espe- not enough to consider the risks posed by applications (e.g.
cially when advanced identification and authentication FTP, Telnet, WWW, etc.) alone—it is equally important to
techniques are in use. For example it is pointless to sniff understand the risks posed by the network protocols, such as
one-time passwords, or responses to challenges issued by TCP, IP, and the many others outside the scope of this
cryptographic authentication mechanisms, e.g. S/Key, section such as IPX/SPX, NETBUEI, SNA, etc.
SecureID, Lockout, etc. However, because all of these
advanced authentication techniques happen at connection
time, no protection is afforded by them after this point. 2.3. RST and FIN attack
Therefore, the attacker simply hijacks a legitimate connec-
tion to gain entry to a system. This has the added advantage 2.3.1. Description
of appearing to the operating systems security mechanisms As mentioned previously TCP packets have control flags
as the legitimate user! which indicate the status of a segment. There are two flags
in particular, RST and FIN, which can be used for denial-of-
service attacks. Under normal circumstances the RST flag is
2.2.3.1. Countermeasure. Again, the simplest and most
used to reset a connection, while the FIN flag indicates that
effective defence against IP spoofing, TCP spoofing, and
no more data will be sent. As with TCP session hijacking,
TCP session hijacking lies with those organisations
the only requirement for this attack to be practical is that the
providing access to the Internet. If all of these
attacker must have access to the IP datagrams sent between
organisations were responsible enough to prevent IP
the target and spoofed hosts. This is necessary so that a
datagrams with source addresses originating from outside
protocol analyser can be used to collect the IP datagrams
their networks from reaching the Internet, the attacks
and obtain correct TCP sequence numbers.
described above could not be carried out.
For an RST or FIN to be accepted, the TCP segment need
Unfortunately, there are many organisations that provide
only have the correct sequence number as the acknowledge-
unregulated Internet access. Therefore other means for
ment number field (ANF) is not used (i.e. there is no ACK in
protecting against spoofing and hijacking attacks must be
a RST segment). Therefore, the attacker simply analyses the
used. The simplest and most effective is for an organisation
IP datagrams in the connection between the target and
to block all the IP datagrams from the Internet that are
spoofed hosts, and calculates (from the target host’s
source routed, or that have source addresses originating
ACKs) the sequence number that the target host would
from the internal network. A properly configured firewall
expect the next TCP segment from the spoofed host to
can be used to enforce such a policy.
contain. The attacker then generates a TCP segment with
Also, trust relationships (e.g. .rhosts) between hosts
the RST flag set and sends it in a spoofed IP datagram (i.e.
communicating across the Internet should never be
containing the spoofed host’s IP address in the source
permitted, unless they are used in conjunction with strong
address field), to the target host. On receipt, the target
authentication and cryptography 8 —they are simply too
host will close the connection with the spoofed host.
vulnerable! In fact, strong authentication and cryptography
A very similar attack can be launched with the FIN flag,
should be used with all TCP services (e.g. such as Telnet,
which is the normal way that a TCP connection is closed.
FTP, etc) where it is possible that an untrusted user could
The attacker uses a protocol analyser to predict the correct
gain more than a very basic control over the operating
sequence number, using it to construct a TCP segment with
system hosting the service. For example, an anonymous
the FIN flag set. This is then sent to the target host which
FTP server that provides read-only access to files can be
assumes that the spoofed host has no more data to send. Any
adequately protected by the security mechanisms in existing
further TCP segments sent by the spoofed host are ignored
operating systems, such as Unix, and Windows NT. It is also
because the target host assumes that they are network errors.
important to assess the threat—for instance it is unlikely
The advantage of a FIN based attack is that TCP mandates
that an attacker would go to the trouble of hijacking an
that on receiving a segment with the FIN flag set, the host
8
It is important to note that strong authentication and cryptography are
must reply with one of its own. From the attacker’s perspec-
not mutually exclusive. For example SSL can provide session encryption tive, the beauty of this attack is that it can be 100% guar-
and strongly authenticate both the client and the server. anteed to be successful!
892 B. Harris, R. Hunt / Computer Communications 22 (1999) 885–897

2.3.2. Countermeasures the “Ping” request. Hence the maximum allowable size of
Normally, RST and FIN attacks are only applicable to the the data area is 65 535 2 20 2 8 ˆ 65 507 octets.
internal networks of an organisation. The reason for this is What makes the “Ping O’ Death” attack possible is the
that an attacker needs to analyse the IP datagrams sent by ability to send an echo request datagram with more than
either the target or spoofed host to determine the correct 65 507 octets of data, and because of the way IP fragmenta-
sequence number. For the attacks to be carried out on the tion is performed. IP fragmentation relies on an offset value
Internet the attacker would have to have access to an Inter- in each fragment to determine the order in which the indi-
net routing node at some point between the hosts being vidual fragments should be reassembled. Thus on the last
attacked—for most attackers access to such resources is fragment, it is possible to combine a valid offset with a
impossible. suitable fragment size such that (offset 1 size) . 65 535.
Denial-of-service attacks can prove to be particularly Since operating systems typically do not process the data-
malicious. Take for example a critical online database that gram until they have reassembled all the fragments, there
has an HTML interface which allows users to enter data. A exists the possibility of overflowing internal variables, and
malicious attacker could continually interrupt the commit buffers which can lead to system crashes, reboots, kernel
phase (i.e. where the data is sent from the WWW-browser to dumps, etc.
the WWW-server) to prevent users from completing their Unfortunately, “Ping O’ Death” is easy to exploit, espe-
work, or to corrupt the database. As a further example cially for those that have operating systems that allow users
consider a WWW server that provides information to to send Pings of illegal size, such as Windows 95, Windows
users. Here an attacker could indiscriminately close connec- NT, and Linux. The following command is all that is needed
tions during downloads causing many browsers to hang. to launch the attack from Windows 95:
These attacks would cause a great deal of confusion and
. ping-l 65510 your.host.ip.address
be particularly difficult to resolve, i.e. is it a software,
network, or hardware fault? Assuming the attacker does Windows 95 will reply with “Request Timed Out”, which
not wish to be caught they would stop their attack once an means that the Ping was not answered, either because the
investigation was initiated and resume it once the investiga- remote host has correctly ignored the illegal Ping; or
tion had finished—the infuriating, unpredictable, intermit- because it is now “dead”—it is that simple!
tent fault!
Unfortunately, configuring routers and gateways on the 2.4.2. Countermeasure
internal network to block such attacks is difficult, and often Once it has been determined that hosts are at risk, the best
impracticable because of the distributed nature of user solution is to obtain patches for the operating systems
groups and information resources. In such environments involved. Fortunately, the “Ping O’ Death” attack is now
there is little that can be done to protect against such mainly of historical interest as most operating systems
denial-of-service attacks. released since 1996 are immune 9, or have patches freely
available. The attack is only possible because of insufficient
error handling within the effected operating systems, not
2.4. Ping O’ death because of vulnerabilities inherent in the IP protocol itself.
However, if patches are not available a quick solution is
2.4.1. Description
to block Ping at the firewall. Unfortunately, blocking Ping
The Ping program tests whether a host is reachable by
messages also prevents legitimate use and may prevent
sending it an ICMP echo request message and receiving an
certain applications from functioning properly. A better
ICMP echo in reply. Ping also measures the round—trip
solution than blocking all Pings is to block only fragmented
time to the host, which provides an indication as to how
Pings. This allows common and legitimate 64-byte Pings
distant the host is, and is helpful for determining whether
through on most systems, while blocking those that are
the intervening network is congested.
larger than the MTU.
IP datagrams can be a maximum size of 65 535 (2 16 2 1)
Although the focus here is on Ping, it is important to
octets, which includes the header length (typically 20 octets
consider that this attack is in theory applicable to any proto-
if no IP options are specified). Datagrams that are larger
col that relies on IPv4 datagrams but which cannot deal with
than the maximum size that the underlying link layer can
those larger than 2 16 2 1 octets. Thus, it is possible that
handle—the Maximum Transmission Unit (MTU)—are
protocols such as TCP, UDP, and even IPX could be
fragmented into smaller datagrams which are then reas-
effected. The only completely effective solution is to secure
sembled by the receiver. For Ethernet based networks the
the operating system against buffer overflows, and variables
MTU is typically 1500 octets, while on the Internet the
containing illegal values, when reconstructing IP fragments.
MTU is usually 576 octets.
The ICMP echo request resides within the IP datagram, 9
An unofficial WWW-site providing information, and a list of affected
and consists of eight octets of ICMP header information (including available patches) and unaffected operating systems is available
(RFC-792 [12]]) followed by the number of data octets in at http://www.sophist.demon.co.uk/ping/index.html.
 B. Harris, R. Hunt / Computer Communications 22 (1999) 885–897 893

3. Threats to standard TCP/IP services disruption to the system for two days by generating 24 000
email messages, inundating the computers and paralysing
TCP/IP supports the operation of a number of well known the network. To get the systems functioning again required
services (i.e. applications). Traditionally each of these 44 h of work, at an approximate cost of US$4400.
services have been associated with one or more vulnerabil- The second more subtle attack involves information gath-
ities. Only applications that are commonly available on a ering designed to provide the hacker with useful information
number of operating systems, including Unix, and Windows about a computer system and its users. For instance the
NT, are described here. VRFY command sometimes translates a users mail alias
The intention is not to provide a detailed discussion about into their login name. This can be used to identify the
all applications that exist and have potentially exploitable more promising accounts to attack, with tools such as
vulnerabilities. Instead the following sections are intended CRACK.
to provide an overview of the types of problems that are Most problems arise when SMTP is implemented as a
common to applications not included here, and to provide large application, such as sendmail [21]. The threat comes
examples of the threats and vulnerabilities that those imple- from bugs, which inherently manifest themselves within
menting Internet, Intranet, and Extranet networks should be large programs, and configuration problems such as giving
aware of. For complete and detailed information about the application higher privilege. These problems enabled
many other applications and their vulnerabilities the reader one of the most famous Internet security incidents—the
should consult [13–15]. Internet Worm [22] to take place.
Other problems also exist with email attachments, and
3.1. Simple mail transport protocol (SMTP) automated execution of encoded messages such as Multi-
purpose Internet Mail Extensions (MIME). MIME allows
3.1.1. Description specific actions to be encoded in email messages. These
The SMTP [16,17] is used as the basis for most electronic actions can request files to be automatically retrieved and
mail (email). Email is the most popular Internet service [18], returned to the message initiator.
allowing people to communicate by exchanging electronic MIME can also be used to transfer executable programs
messages globally. These messages take anywhere from a and Postscript files, which can themselves perform danger-
few seconds to a couple of hours to be delivered. An added ous actions. These existing security threats are very applic-
attraction is the relatively low cost of sending large able to new, network oriented, programming paradigms
messages. Combined, these benefits give users a convincing such as Java and ActiveX.
argument for access to email, and thus the connection of
their systems to the Internet.
For a full and easy to read description of SMTP the reader 3.2. Telnet
is urged to consult [11]. It must be noted that SMTP is a
developing protocol, and as such, new threats could evolve. 3.2.1. Description
RFC 1425 [19] defines the framework for adding extensions Telnet [23] is designed to enable communication between
to SMTP. any host, regardless of the operating system. Telnet provides
simple character based terminal access, and usually requires
the user to login with an account name and password.
3.1.2. Threats
SMTP used by itself is a fairly benign protocol, contain-
ing only eight basic commands. These are HELO, MAIL, 3.2.2. Threats
RCPT, DATA, QUIT, VRFY, NOOP, and TURN. There are The biggest threat comes during login when initiating the
two security threats associated with these commands; Telnet session, as standard Telnet does not protect the trans-
mission of the user’s account name or password. Anyone
• Denial-of-service
monitoring the Telnet login packets over the network can
• Information gathering
capture this information.
Denial-of-service attacks based on SMTP are aimed at As with any protocol each step is predictable, therefore a
flooding a network or computer with large email messages packet sniffer can be configured to simply detect any Telnet
to prevent legitimate use. In most cases a computer is session and record the packets containing the account name
affected because it cannot handle large messages e.g. . 1 and password.
Megabyte, or cannot handle the load created by receiving Other threats exist, for example the Telnet program itself
large numbers of messages at the same time, or running out could have been compromised to record passwords and
of storage space. account names. A description of such a case is available
For example the Computer Fraud and Security Journal in [24].
[20] reported that a disgruntled university student was To protect against sniffing attacks a number of secure
arrested for “mail bombing” the Monmouth University versions of Telnet have been implemented [25,26]. These
computer system in New Jersey. The attack caused massive versions of Telnet usually encrypt both the password and
894 B. Harris, R. Hunt / Computer Communications 22 (1999) 885–897

session contents which prevents an attacker from obtaining tify promising targets, and provide contextual information
any useful information. to attackers for use with tools such as CRACK. The follow-
ing extract is from RFC 742 and expresses the philosophical
3.3. Network time protocol (NTP) nature of finger. It reflects well the openness of early
networks and contrasts starkly with the more security
3.3.1. Description
conscious 1990s.
The NTP [27] is used to synchronise the clocks of hosts
connected to the Internet. The correct time is generated by To fulfil the basic intent of the Name/Finger
extremely accurate atomic clocks which provide national programs, the returned list should include at least
time synchronisation. Time updates are propagated through the full names of each user and the physical locations
a directed hierarchy of Internet hosts. The propagation path of their terminals insofar as they can be determined.
must not contain any loops as this would cause erroneous Including the job name and idle time (number of
time transfers. minutes since last typein, or since last job activity)
NTP provides accuracy of 10 ms or better; with such is also reasonable and useful.
accuracy comes the ability to match log files from different
The “Finger Bomb” is an interesting use of finger to
systems. This has proved beneficial when matching audit
launch denial-of-service attacks against systems (Note:
logs from different systems and allows an attacker’s actions
this attack has been patched on newer finger services).
to be replayed. It also provides a mechanism for crypto-
Some finger services allow the redirection of finger to
graphic protocols to generate timestamps for authentication
remote sites. To finger through several sites, an intruder
purposes.
could use:
3.3.2. Threats . finger username@hostA@hostB
Attacks on NTP focus on altering a target’s sense of time.
The finger will go through host B then to host A. This
If this succeeds, a time based authentication protocol can be
helps attackers to remain anonymous because host A will
subverted by replaying a previous successful authentication
see a finger coming from host B instead of the original host.
sequence. Protection against these attacks is provided in
This technique has also been used to go through firewalls
newer versions of NTP which provide cryptographic
that have not been properly configured. This can happen by
message authentication. NTP specifies that authentication
using the command:
be carried out on a hop-by-hop basis. It is therefore possible
for an attacker to subvert a system on which the target’s . finger user@host@firewall
NTP daemon relies, and thus subvert the target system as
On vulnerable hosts a denial-of-service attack can be
previously described. To ensure protection against this type
launched by typing:
of attack all sources of NTP information authenticate their
sources, and so on back to the root NTP server. . finger@@@@@@@@@@@@@@@@@@@@hostA

3.4. Finger and whois The repeated @ causes the finger to recursively finger the
same machine repeatedly till the memory and hard drive
3.4.1. Description swap space fill up. This causes the machine to crash or
The finger protocol (RFC 742) [28] provides information slow to an unusable speed.
on users of a specific host. Generally it is used to find out the The best countermeasure available to address the threat
account name of a user and/or whether they are logged on. from finger is to disable it entirely. If this is not possible then
In most cases the person using this command has no more finger should only be allowed to retrieve user information
sinister motives than sending mail. from a sanitised database.
The Whois protocol [29] provides contact information The whois protocol is susceptible to the same types of
such as account name, telephone number and address. It is abuse as the finger protocol, however it does not reveal
useful for looking up people on systems when you do not detailed information about users access habits.
have there full name. For example typing “whois smith” will
return a list of people with “smith” in their name. 3.5. Network file system (NFS)

3.4.2. Threats 3.5.1. Description

Finger can be used by hackers to collect useful informa- The NFS, RFC 1094 [30], protocol provides transparent
tion, such as account names, and compile login profiles i.e. remote access to shared files across networks, and is
the best time to attack the system is when the system admin- designed to be portable across different machines, operating
istrator has finished for the day, or better still, on vacation. systems, network architectures, and transport protocols.
Other useful information supplied can be the date a user last This portability is achieved through the use of Remote
logged in, and a users “plan” file which often contains useful Procedure Calls (RPC) [31].
personal information. This information can be used to iden- To ensure robust NFS access in the event of system
 B. Harris, R. Hunt / Computer Communications 22 (1999) 885–897 895

reboots and device failures (e.g. bridges and routers) the 3.7. World wide web (WWW)
NFS server is stateless, unlike the clients which retain
state. When an NFS server becomes unreachable its clients 3.7.1. Description
continue to send requests until they receive a reply. Thus, The WWW is made up of a collection of protocols speci-
the client’s functioning is not adversely effected by the loss fically designed for exchanging information over the Inter-
of an NFS server. net. The original WWW protocols included Gopher, Wide
Area Information Servers (WAIS), and Archie, however,
3.5.2. Threats the past four years have seen the introduction of the
All files and directories on an NFS server are identified by Hyper Text Transfer Protocol that has revolutionised the
unique strings known as file handles. A threat is introduced Internet. In fact, most laypersons associate the term
if a client program obtains and retains a root file handle at WWW exclusively with HTTP.
mount time, which is usually when the NFS server is re- These protocols are generally used by clients to query
booted. This is possible due to the inadequacies NFS access servers for specific files. HTTP also implements the client/
controls. server model of document retrieval, in this case the client,
Once access to the file system has been achieved it is called a “browser”, is usually capable of multimedia
possible to change file access controls, and create subver- support. The server, referred to as a WWW-server, functions
sive programs and place them in search paths so that the real in a similar manner to a standard file server, simply sending
ones are not used e.g. trapdoor or password gathering the requested documents to the browser. However, WWW-
programs. servers are also capable of running programs to create
HTML documents dynamically as they are requested, this
3.6. File transfer protocol (FTP) makes them very useful for maintaining documents in
dynamic environments. In fact HTTP was originally devel-
3.6.1. Description oped by physicists at CERN laboratories as a means of
The FTP, RFC 959 [32], enables the transfer of character exchanging papers pertaining to their research. These docu-
and binary files across a network. The design philosophy ments where constructed using HTML which is based on the
does not dictate a specific host, operating system or file Standard Generalised Markup Language (SGML).
structure—it is completely independent. What makes HTML so attractive is that a document can
An FTP server uses two TCP ports to transfer a file. incorporate small programs that allow the content to
Control Connection is established on Port 21, and Data become dynamic. These programs, referred to as executable
Connection on Port 20. The FTP client is free to choose content, can either be included as scripts within the docu-
any available port. ment (e.g. Java Script), or as compiled programs which are
FTP has become the standard for publishing software, loaded separately when the document is accessed (e.g. Java
data, and documents on the Internet. However Adobe Acro- and ActiveX).
bat and Hyper Text Transfer Protocol (HTTP) using the
Hyper Text Markup Language (HTML) are becoming popu-
lar for documents. 3.7.2. Threats
There are four categories of web security threats:
3.6.2. Threats
• Alteration of the web site data
The major threat to FTP comes from improperly managed
• Access to the web server operating system
FTP services. For example if an organisation runs a public
• Eavesdropping browser–server traffic
FTP service but does not separate its sensitive organisa-
• Impersonation of another web server
tional data, then with today’s network speeds it may be
possible to download all the sensitive data in a matter of The first two currently present the greatest threats. Rogue
minutes. FTP services should be restricted to certain, well code can cause buffer overflow and exception conditions
managed, file areas. that in turn provide access to the operating system. Intruders
FTP has been used to gain access to password and remote can embed commands in web requests in such a way to trick
host files by exploiting deficiencies in management of the the web server into passing the command to the operating
service. For example, if file areas are not controlled then the system. It is therefore essential that all patches are installed
user is able to change access controls to files. It may be and only minimum system privileges are enabled.
possible to insert false password or remote host files, More specifically transferred files can contain executable
which can then be used to gain access to other hosts. content such as format tags which are used to identify the
Like Telnet, the standard FTP protocol does not encrypt program necessary to view or execute the files. Further,
passwords that are required for the user to login to a system, firewalls and network guards must be configured to permit
so there is a high risk that the password can be compromised outgoing HTTP connections. This means that unknown
by anyone listening into the network. FTP sites are also used programs contained in the HTML pages can be downloaded
as promulgation points for pirated software. onto a users computer and executed, effectively bypassing
896 B. Harris, R. Hunt / Computer Communications 22 (1999) 885–897

the firewall and any security policy that attempts to control which enables multiple clients to use the bit-mapped display
the unauthorised use of untrusted software. managed by a server, which also manages the keyboard, and
Fortunately, several solutions have emerged to deal with mouse. The client is an application program which runs on a
this problem. The first limits the access that the software has host with the server or on a different host.
to system resources. For example, Java Script runs within the X windows requires a reliable, bi-directional stream
environment created by the browser and does not have direct protocol such as TCP. Communication between client and
access to system resources (e.g. hard disk, device drivers, server consist of 8-bit bytes. On UNIX systems where the
memory, etc). Similar constraints are also applied to Java server and client are on the same host, UNIX domain proto-
applets, although these can be relaxed to some extent by the cols are used to reduce the overhead of the TCP protocol.
user [33]. The most dangerous executable content is Micro-
soft’s ActiveX, these programs, known as “controls”, are in 3.8.2. Threats
fact executable binaries (i.e. compiled Microsoft Windows An application which connects to an X server is able to do
C11 programs). They are executed by the browser in the a multitude of things, e.g. read the keyboard, print the
same manner that a user runs a program. Because of this the screen, read mouse movements/button presses, simulate
ActiveX control has the same access rights to system resources key-presses, resize windows, etc. If an attacker can connect
as the user running the browser. For example, an ActiveX to a server and read the keyboard, the user will be compro-
control downloaded by a user with administrator privileges mised. It is possible for an attacker on the Internet to probe
would have full control of the computer, and possibly other for X servers, as X server ports are assigned as 6000 1 n,
machines if connected to a network. where n is some small integer, usually 0.
Use of SHTTP (Secure-HTTP) and SSL/TLS (Secure The X windows system uses host based authentication.
Socket Layer/Transport Layer Security) allow client– The server takes the network source address of the connect-
servers to negotiate acceptable levels of security for parti- ing application and compares it with a list of allowable
cular transactions [34]. To address the problem users have in sources. However, there is no protection from an attacker
deciding whether executable content can be “trusted”, Nets- connecting from a trusted host.
cape and Microsoft have developed technologies based on Another protection mechanism makes use of a magic
public key cryptography that allow Java applet and ActiveX cookie which is a secret byte string which the server and
control code to be digitally signed. A browser that down- application share. Processes cannot connect to a server
loads a signed ActiveX control or Java applet can check the unless they contain this string. The problem is communicat-
signature against a list of trusted certificates. If signed ing the secret string between application and server over a
correctly the user can choose to execute the program with generally unsecured network.
confidence that it came from a trusted source. Browsers A similar cryptographic challenge/response protection
from Netscape and Microsoft are pre-loaded with certifi- mechanism exists, but suffers from the same key distribu-
cates from a number of well respected organisations. The tion problems as the magic cookie.
benefit of this technique is that an organisation can remove
all default certificates and install their own, effectively
restricting executable content to that developed by the orga- 4. Summary
nisation. This can be enforced because the above browsers
can be configured to enforce particular security policies. The TCP/IP suite was never intended to offer comprehen-
Another solution provided by many of the newer firewalls sive, scaleable security mechanisms, and it is the lack of
allows HTML tags (i.e. hyper-links) that load the executable such mechanisms that underlie most of the problems with
content to be disabled. Some firewalls can also be config- IPv4 and TCP. However, many solutions have been
ured to check the signatures of Java Applets and ActiveX presented here and most are readily available without
controls, and allow through only those signed by trusted great expense. For example, there is little expense in ensur-
certificates. This has the added benefit of enforcing the ing that trust relationships (e.g. rlogin) do not exist, or in
security policy at a central point, rather than delegating it applying patches (e.g. Ping) and keeping them up-to-date.
to the browser where it may be possible for a user to alter the Perhaps the most important point is that all organisations
security policy locally. should act responsibly to prevent malicious traffic from
In most cases the solution to the problem of executable reaching the Internet. As discussed most attacks to the IP
content is similar to FTP and other services. That is, services and TCP (e.g. SYN flooding, IP spoofing, etc.) could be
should be run in an enclosed environment with only enough averted by preventing IP datagrams leaving an organisa-
privilege to perform their task. tion’s network if its source address did not originate from
within. Unfortunately, not all organisations are so responsi-
3.8. X window system ble thus attacks which could be easily prevented are still
possible.
3.8.1. Description It has also been shown that many applications pose signif-
The X window system [35] is a client/server application icant risks to organisations. Most problems are caused
 B. Harris, R. Hunt / Computer Communications 22 (1999) 885–897 897

through deficiencies in the implementation (e.g. buffer over- [13] W. Cheswick, S. Bellovin, Firewalls and Internet Security—Repel-
flows, unhandled exceptions, etc.) Therefore, it is essential ling the Wily Hacker, Addison-Wesley, Reading, MA, 1994.
[14] S. Garfinkel, G. Spafford, 2, Practical UNIX and Internet Security,
that applications are kept up-to-date by applying patches or April, O’Reilly and Associates, Sebastopol, CA, 1996.
service packs that address new exploitable vulnerabilities. [15] C. Hare, K. Siyan, Internet Firewalls and Network Security, 2, New
Other problems are caused by uneducated users or short- Riders Publishing, Indianopolis, IN, 1996.
comings in the organisations security policy. Also, it [16] R. Braden (Ed.), Requirements for Internet Hosts-application and
remains to be seen what problems, and financial losses, support, RFC 1123, October, 1989.
[17] J. Postel, Simple Mail Transfer Protocol, RFC 821, August, 1982.
new WWW technologies (e.g. ActiveX controls, Java [18] R. Caceres, P. Danzig, S. Jamin, D. Mitzel, Characteristics of wide-
applets) will inflict. area TCP/IP conversations, Computer Communication Review 21 (4)
It is expected that IPSEC and IPv6 will solve many of the (1991) 101–112.
problems associated with the existing TCP and IP imple- [19] F. Klensin, T. Rose, E. Stefferud, D. Crocker, SMTP Service Exten-
mentations. However, deficiencies and errors in the imple- sions, RFC 1425, February, 1993.
[20] Computer Fraud and Security Editorial, February, Elsevier, Amster-
mentation of applications, along with corrupt employees, dam, 1996 p. 3.
will continue to introduce new generations of threats and [21] B. Costales, E. Allman, N. Rickert, Sendmail, O’Reilly and Associ-
vulnerabilities. ates, Sebastopol, CA, 1993.
[22] E. Spafford, An analysis of the Internet worm, Proceedings of the
European Software Engineering Conference, September, 1989. Avail-
References able at ftp://ftp.cs.purdue.edu/pub/spaf/security/IWorm.PS.Z
[23] J. Postel, J. Reynolds, Telnet Protocol Specification, RFC 854, May,
[1] CSI/FBI Computer Crime and Security Survey. Computer Security 1983.
Institute, 1998. Available athttp://www.gocsi.com/prelea11.htm. [24] D. Safford, D. Schales, D. Hess, The TAMU security package: An
[2] H. DeMaio, Internet Security: Connecting Without Fear. Info Security ongoing response to Internet intruders in an academic environment,
News (Supplement), Published by M.I. Sobol, 1995. Proceedings of the Fourth Usenix UNIX Security Symposium, Santa
[3] R. Hunt, Internet/Intranet firewall security-policy, architecture and Clara, CA, October, 1993, pp. 91–118. Available at http://www.ta-
transaction services, Computer Communications 21 (13) (1998) mu.edu/pub/mirrors/net.tamu.edu/tamu-security-overview.ps.gz
1107–1123. [25] D. Borman, Telnet Authentication Option, RFC 1416, February,
[4] Computer Weekly, November 16, 1995. 1993.
[5] A. Rosen, Understanding and Defending Against SYN Attacks, in: [26] D. Safford, D. Hess, D. Schales, Secure RPC authentication (SRA) for
Proceedings of Discrete Mathematics and Theoretical Computer Telnet and FTP, Proceedings of the 4th Usenix UNIX Security
Science Workshop on Network Threats, National Science Founda- Symposium, Santa Clara, CA, October, 1993, pp. 63–67.
tion-Science and Technology Center Piscataway, NJ, December, [27] D. Mills, Network Time Protocol (version 3) specification, implemen-
1996. (http://www.gocsi.com/prelea11.htm). tation and analysis, RFC 1305, March, 1992.
[6] Project Neptune. Phrack Magazine, Vol. 7, Issue 48, July, File 13. [28] K. Harrenstien, Name/Finger Protocol, RFC 742, December 30, 1977.
1996. Available at http://www.phrack.com/Archives/phrack48.zip [29] K.M. Harrenstien, V. White, Nicname/Whois. RFC 812, March 1,
[7] S. Bellovin, Security problems in the TCP/IP protocol suite, Compu- 1982.
ter Communication Review 19 (2) (1989) 32–48. Available at ftp:// [30] Sun Microsystems, NFS: Network File System Protocol Specification,
ftp.research.att.com/dist/internet_security/ipext.ps.z RFC 1094, March, 1989.
[8] R. Morris, A weakness in the 4.2BSD UNIX TCP/IP software, [31] RPC: Remote procedure call protocol specification: Version 2, RFC
Computing Science Technical Report 117, AT&T Bell Laboratories, 1057, June, 1988.
February 25, 1985. Available at ftp://netlib.att.com/netlib/research/ [32] J. Postel, J. Reynolds, File Transport Protocol, RFC 959, October,
cstr/117.z 1985.
[9] L. Joncheray, A simple active attack against TCP, Proceedings of the [33] A. Rubin, Blocking Java Applets at the Firewalls, Proceedings of
5th USENIX UNIX Security Symposium, Salt Lake City, Utah, June Discrete Mathematics and Theoretical Computer Science Workshop
5–7, 1995, pp. 7–19. on Network Threats, National Science Foundation, Science and Tech-
[10] IP Spoofing Demystified: Trust Relationship Exploitation. Phrack nology Center, Piscataway, NJ, December, 1996. (http://dimacs.rut-
Magazine, Vol. 7, Issue 48, June, File 14, 1996. Available at http:// gers.edu/Workshops/Threats/program.html).
www.phrack.com/Archives/phrack48.zip [34] B.C. Soh, S. Young, Network system and world wide web security,
[11] W. Stevens, TCP/IP Illustrated: The Protocols, Addison-Wesley, Computer Communications 20 (1998) 1431–1436.
Reading, MA, 1994. [35] R. Sceifler, J. Gettys, X Window System, 3, Digital Press, Belford,
[12] J. Postel, Internet Control Message Protocol, RFC 792, September, 1981. MA, 1992.