1. Address Spoofing, DoS, and VoIP Groups 5 and 6

2. Spoofing, DoS, and VoIP MAC Address Spoofing MAC Address Spoofing IP Spoofing IP Spoofing DNS Spoofing DNS Spoofing TCP Spoofing TCP Spoofing DoS DoS E-mail Spoofing E-mail Spoofing VoIP Vulnerabilities VoIP Vulnerabilities

3. MAC Address Spoofing Windows: Control Panel setting Windows: Control Panel setting Linux: Linux: –ifconfig eth0 hw ether –ifconfig eth0 hw ether Detection: arpwatch Detection: arpwatch

4. IP Spoofing wINJECT wINJECT Fraggle Fraggle Stream Stream Detection: Detection: –Monitor traffic at border gateways

5. DNS Spoofing dsniff dsniff –Add to hostfile: –dsniff –i eth0 –f hostfile

6. DNS Spoofing Early warning: Early warning: –DoS slowing down valid DNS responses Prevention: Prevention: –Eventually, DNSSEC –Now: Server – SSL Server – SSL Client – check SSL certificate or use whois to confirm IP address Client – check SSL certificate or use whois to confirm IP address

7. TCP Spoofing Invading the Three-Way Handshake Invading the Three-Way Handshake A DoS attack: tcpkill A DoS attack: tcpkill Other dangers: SMTP Other dangers: SMTP –No need to be on network Defenses: Defenses: –Border routers should filter improper IP’s –What if hacker is on the network?

8. TCP Spoofing (cont.) Defense: Don’t get denied service! Defense: Don’t get denied service!

9. DoS Attacks Datapool: 106 DoS attacks Datapool: 106 DoS attacks Synful: SYN attack Synful: SYN attack Teardrop: fragments Teardrop: fragments UDPflood UDPflood Extra Attacks: Were any effective? Extra Attacks: Were any effective? Defenses hard to generalize Defenses hard to generalize

10. E-mail Spoofing Causes SMTP protocol does not authenticate SMTP protocol does not authenticate –Can include arbitrary FROM: address Mail servers become open relay for spammers Mail servers become open relay for spammersSolutions SMTP AUTH extension SMTP AUTH extension Certified Server Validation (CSV) and Sender Policy Framework (SPF) Protocols Certified Server Validation (CSV) and Sender Policy Framework (SPF) Protocols –Verify sender’s IP address with DNS entry

11. VoIP Security Sound data transmitted unencrypted Sound data transmitted unencrypted Vomit Vomit –Ethereal output to.wav conversion SIP supports encryption (S-RTP) SIP supports encryption (S-RTP) Voice over IP Security Alliance (VOIPSA) Voice over IP Security Alliance (VOIPSA)

12. Sources http://www.dnssec.net/ http://www.dnssec.net/ http://www.iglu.org.il/august/tcp- spoofing-html/ http://www.iglu.org.il/august/tcp- spoofing-html/ http://www.csvmail.org/ http://www.csvmail.org/ http://www.openspf.org/ http://www.openspf.org/ http://www.voipsa.org/ http://www.voipsa.org/

13. Questions ?