Sniffing and Session Hijacking

Lesson 12

Session Hijacking

• Passive• Attacker hijacks a session, but just sits back and

watches and records all of the traffic that is being sent back and forth

• Also referred to as “sniffing”• Active

• Attacker finds an active session and takes over.• Done by forcing one of the parties offline,

where the user can no longer communicate – usually done with a Denial of Service attack.

Sniffing

• Sniffers are programs or HW devices that monitor (“listen in to”) traffic flowing across a network.• They can pull in all packets or be selective and only

grab packets destined for certain addresses or that carry a certain type of traffic

• For a sniffer to work correctly, it needs to view all of the traffic going across a network. Thus, it must be on internal network or on main connection into/out of a network.

Computer Network Monitoring

• Port Scanning• Keystroke Monitoring• Packet sniffers

• takes advantage of “friendly” nature of net.• Grabs packets not destined for system• used by

• hackers• sysadmins• Law enforcement agencies

IP Packet

Version Length Type of Srvc Total Length

Identification Flags Fragment Offset

Time to live Protocol Header Checksum

Source Address

Destination Address

Options

Data

4 8 16 19 32

SnifferPro

SnifferPro

SnifferPro

SnifferPro

NetXray

TCP packet

Dataoffset

Unused

U A P R S FR C S S Y IG K H T NN

Window

Source Port

Urgent Pointer

Sequence Number

Acknowledgement Number

Options Padding

Data

4 8 16 32

Destination Port

Checksum

NetXray

Van Eck reception

• Relies on the fact that electronic equipment radiates electromagnetic signals which can be intercepted

• With the proper equipment signals can be recreated up to 1 kilometer away

Seizing the Signals

• Eavesdropping on conversations• “listening in”, the content

• Traffic analysis• data about the signals themselves

Eavesdropping

• Cellular Intercepts• extremely vulnerable to interception

• Pager Intercepts• also fairly simple

• Law Enforcement Wiretaps• generally require court order with probable cause

• Foreign Intelligence Intercepts• US and others have VERY active program in this

arena

ECHELON

Sniffing VoIP sessions

Defeating Sniffer Attacks• Detecting and Eliminating Sniffers

• Possible on a single box if you have control of the system• Difficult (depending on OS) to impossible (if somebody

splices network and adds hardware) from network perspective

• Safer Topologies• Sniffers capture data from network segment they are

attached to, so – create segments• Encryption

• If you sniff encrypted packets, who cares?• (outside of traffic analysis, of course)

Traffic Analysis

• Looks at activity, not contents• Pen Registers and Tap & Trace

• pen registers provides access to the numbers that are dialed from a phone

• tap & trace provides incoming numbers• Location Tracking

• possible with cellular phones• can work even when phone not in use

Session Hijacking

• Review for a second, the three-way handshake in TCP:

User Server

SYN (SN-U)

SYN(SN-S),ACK(SN-U+1)

ACK (SN-S+1)

Revisit Sequence Numbers

• Depending on the session to be hijacked, you may or may not be able to observe the traffic and thus know the sequence number.

• Sequence numbers are• 32-bit numbers,• Used by recipient to know what order to put received

packets in, and• To acknowledge packets received so sender knows if it

has to resend a packet.• There is one for the sender and one for the receiver

Steps in Session Hijacking

• Find a target• Perform sequence number prediction• Find an active session• Guess the sequence numbers• Take one of the parties offline• Take over the session

Find a target

• Need to find a suitable target• Need to be able to sample sequence numbers

• Need to be able to get through the firewall for this

• Needs to have connected sessions• Probably should be a server that allows session-

oriented connections (e.g. telnet or FTP)

Perform sequence number prediction

• If you can view the traffic, no problem…• Predictability of sequence number depends

on OS (Windows more predictable)• Use scanning tool to determine OS (e.g. nmap)

• Attempt several connections and observe sequence numbers to see how random the sequence is – gather information.

Find an Active Session

• In session hijacking you want to take over a session – you want somebody to be around• This is opposite of usual hacker activity where

you don’t want folks around to notice activity• The more traffic the better off since there will

less chance of somebody noticing (individual may assume heavy traffic is causing them any network problems experienced)

Guess the sequence number

• For communication to occur need several things:• IP address (doesn’t change during session)• Port number (doesn’t generally change)• Sequence number (changes each packet sent)

• Thus, attacker must successfully guess sequence number to hijack session

• Goal is to get server to accept packet sent, take some educated guessing based on knowledge of sequence predictability

Take One of the Parties Offline

• Once you’ve guessed the correct sequence number, time to eliminate the sender so you can take over the session.

• Generally done with some form of Denial of Service attack.• Server still responds to original system but it

never knows because it has been taken out.

Take Over the Session

• Now the attacker has everything set up• Session• Sequence number• Sender (usually client) taken out

• Now exploit session, ideally something like a telnet session where you can issue commands such as creating a new account or adding system to list of trusted systems.

Hijacking, doesn’t sound so simple…

• In theory, it is very complex, fortunately there are some programs out there that can help you.• Juggernaut• Hunt• TTY Watcher• IP Watcher

• All of these are of the “sniffer” type, must see traffic to be able to hijack it.• Think about what is needed to hijack a session you

can’t see.• Remember, however, that I don’t need to be able to sniff all

traffic to a server, I can be sniffing at the client side.

Protecting Against Session Hijacking

• Use encryption• Use a secure protocol (usually includes encryption)

• Limit incoming connections• Minimize remote access (referring to outgoing)• Have strong authentication (though this is less

effective in protecting against hijacking since you are taking over a session after authentication has taken place.)

Summary

• Hijacking is a real threat• Technology is straightforward• Many tools available to do this• There are legal ramifications