An advisory posted on the comp.security.announce Usenet newsgroup by the Computer Emergency Response Team (CERT), a government-sponsored Internet security watchdog group at Carnegie-Mellon University in Pittsburgh, Pa., reported that intruders had created "spoofed" source IP addresses, allowing them user -- and sometimes even root -- access on targeted systems by taking control of open terminal or log-in sessions.
The report indicated that potentially vulnerable configurations included routers to external networks that support multiple internal interfaces; routers with two interfaces that support subnetting on the internal network; and proxy firewalls where the proxy applications use the source IP address for authentication.
The advisory suggested administrators use network-monitoring software to look on external interfaces (known as input filters) containing both source and destination IP addresses in local domains to detect such an infiltration. If such packets are evident, your internal network is probably under attack.
To prevent such intrusions, CERT suggests companies install filtering routers that restrict input to external interfaces by not allowing in packets that contain source addresses from internal networks. The group also suggests companies filter outgoing packets that have a source address different from the internal network's to prevent a source IP spoofing attack originating from your site.
According to Nick Trio, chair of IBM's Internet Council and networking guru at IBM's Thomas J. Watson Research Center, the IBM NetSp Secure Network Gateway is a good step toward preventing this kind of attack since "it uses a smart card for authentication rather than the IP source address." However, he suggests that with hijacking attacks, such as the one that occurred in San Diego, no one is safe.
"IBM is looking hard at this problem, since it's endemic to many networking technologies," says Trio. "In this instance, the answer may either be session encryption or `continuous authentication,' which occurs between client and server beyond the start of the connection."
See also:
The People Network