 |
 |
 |
|
 |
Since the invention of firewalls, no major technology development has occurred in computer, network, and application security in the last 10 years. Firewalls came as the first measure to provide some security, after local networks and the Internet were set up to simply provide ubiquous connectivity with no concern for security. The network devices directing the traffic (i.e. routers) could be configured for some basic security (by way of Access Control Lists - ACLs), but due to very limited CPU capabilities, and an enormous cost in performance, proved to be of little use for security. The introduction of firewalls then allowed to function as a gateway on the perimeter, to authenticate access, and to restrict the total number of 65,535 TCP and 65,535 UDP communication channels to the few ports actually used. However, this approach provides at best a "Swiss Cheese", as the ‚open' ports - i.e. the most popular ones - remain available for both valid traffic (such as web access, e-mail, file transfer, encrypted traffic, etc) as well as invalid traffic, since firewalls have to pass all traffic without discrimination, and do not have the ability to make decisions, which traffic is valid, and which is not. In addition, firewalls and all other devices communicating with a TCP/IP protocol ("stack") are addressable, and can be directly attacked themselves. By sending malformed data, non-complying with the established protocol rules, or carefully crafted to operate outside established boundaries, every single one of such devices can be very quickly eliminated ("crashed"), thus disrupting communications and shutting down the availability of resources.
Penetration Testing: Mapping VulnerabilitiesAdditional tools allow for an exploitation of configuration, thus mapping the infrastructure, and providing an exact catalogue of deployed hardware, software, and its configuration, which in turn can be easily used to determine the weak points ("vulnerabilities") and to exploit those in targeted attacks. These tools are freely available and very powerful ("Penetration Testing Probes"). Programs such as NMAP or NESSUS will provide such maps of an entire architecture design, and in addition even rate the difficulty for compromise.Such vulnerabilities can then be exploited even further, with distributed Denial-of-Service (dDoS) attacks. distributed Denial-of-Service (dDoS)What is a Denial-of-Service (DoS) attack?Broadly defined, a DoS attack seeks to overwhelm the capabilities of the targeted site, either from the outside (the Internet) or from the inside (internal systems), with the intention to disrupt (deny) service - by disabling ("crashing") the targets or by sending so much traffic, that the target is no longer able to respond.These attacks come in many different flavors. The can be very small, sending a short burst of only a few malformed packets (such as in "shrew" attacks, "synk4", or "synk5" attacks) against just one critical system, representing a key, single-point-of-failure component (such as a firewall), and almost instantly taking it down, thus shutting down access to and from all systems behind this device. The attacks can also be very large. The concept of "bot-networks" has matured, in which a large number of computers on the public Internet are quietly (without the knowledge of the owner) compromised, and thus listen to a single command from a "bot-net-operator" to send attack traffic against a particular target simultaneously with thousands (or even millions) of other computers. These attacks are usually carefully crafted, and hide the IP address of each such computer, pretending with each individual packet sent to come from a different IP address (this function is called "sender address spoofing"). Since this form of DoS attack comes from so many distributed systems, it is called distributed Denial-of-Service, or dDoS, attack. With existing security measures, the attacked site has no means to determine which part of the incoming bandwidth is valid traffic from regular visitors with their correct IP addresses, and which part is invalid, coming from "spoofed" computers. Consequently, the attack is successful, usually works immediately, and keeps the targeted site offline, until a central command is issued to all the systems in such a "bot-net" to cease the attack. This method is virtually risk-free to the attacker, as it is technically impossible to identify all the participating computers in a "bot-net", and trace back from those to the operator, issuing the single attack and cease commands. Even if that were possible, the attacker is likely located in a different jurisdiction than the targeted site, thus excluding any reasonable possibility to take appropriate action. Distributed Denial-of-Service attacks have become increasingly popular in the last years. They are used by organized crime groups to extort large sums of money from e-commerce services (for example, virtually all online betting sites in the UK are paying extortion fees after several large attacks), they are used by political groups (news sites have been shut down for extended periods of time), and the risk of terrorists attacking entire countries with the desire to disrupt that countries' Internet commerce, communication channels, and economy is another great concern to Government officials.
This functionality, now for the first time available with Melior's Barbican RNP, goes deeper, to Layer 2 and 3 of the OSI model, while inspecting traffic on application Layers 4 and above for validity as well.
300 million users, who were already successfully protected against dDoS attacks by Melior CyberWarfare Defense technology, attest to the validity of the CyberWarfare Defense layer. Additional testimonials demonstrate the benefits of PenTest defense, reduced processing loads on firewalls as a result, reduced log sizes, and additional financial benefits in the reduction of IT staff ressources. |
|
© Copyright 1987 - 2006 Melior, Inc. - CyberWarfare Defense
Trade- and Servicemarks, Copyrights, and Patent-Pending Protection is effective in WTO countries.
v 09062010-1927 NetGroup GmbH Dortmund/MEZ