/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\ ^ AttackinG-DefendinG > < BY ^ > |[xHostiLe]| < ^ > > LeAdEr: CYbER-StrikE ^ < < ^ > \/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/ OK, first off, I will do my best to cover the vast world of attacking as we know it. There are many different types of attacking that you should be aware of. To many to cover all in one text phile but I'll do my best. /\/\/-> Attacking <-\/\/\ --TypeS-- *ICMP ICMP, otherwise known as the InternetControlMessageProtocol, is used for error messages, and other messages intended for the TCP/IP software itself, rather than any particular user program. For example, if you attempt to connect to a host, and you cannot connect to this host for whatever reason, you may get back a message stating "host unreachable". One types of ICMP's, the "ICMP_unreach" packet. ICMP can ALSO be used to find out info on a network. ICMP is SIMILAR to UDP, in some ways that it handles messages that fit into one packet. Thats where certain ICMP DoS attacks come in, oversize ICMP's. Alike though simplier then UDP. EX it does not have any port numbers in its header. Since all ICMP messages are interpreted by the network software itself, port numbers are not needed to direct where a ICMP message is to go. How can ICMP be used maliciously you ask? Well, ICMP pings can be harmful if flooded. Especially if the malicious user redirects the ping_replys back to the victem. Oversized fragmented ICMP packets sent to a host may be harmful, as when the host attempts to defragment the oversized ICMP packet it may panic and the host might have to result in rebooting. Now imagine a malicious user flooding the host with such oversized fragmented ICMP packets at a fast rate, damage is almost sure to be done. =-ProtectioN-= Firewalls offer some degree of protection against ICMP floods and oversized fragmented packets. There are also patches for this. Certain protection utilities are writtin just for the purpose of blocking such attacks. =-OS(s) EffecteD-= WinNT & Win95 can be crashed by ICMP oversized fragmented packets and ICMP flooding. All OSs are liable to ICMP flooding. =-AdditionaL NotE-= Sping was created to exploit such an attack. Although it is an old attack and most of the computer population has protection from this, I'm sure there are some lamerz out there unaware of this attack. o0o0o0o0o0o0o0o0o0o0o0o0o0o0o0 *UDP UDP, otherwise known as UserDatagramProtocol, is designed for applications where you don't need to put sequences of packets together. Instead, it fits into the system much like TCP. There is a UDP header, and the network software puts the UDP header on the front of your data, just as it would put a TCP header on the front of your data. Then UDP sends the data to an IP, which then adds the IP header, putting UDP's protocol number in the protocol field instead of TCP's protocol number. However UDP does not do as much as TCP. For instance, it does'nt split data into multiple packets, it does not keep track of what it has sent so it may resend if necessary, ect. Just about all UDP provides is port numbers, so that several programs can use UDP at once. UDP port numbers are used just like TCP port numbers. There are well known port numbers, such as 139, 113, 23, for servers that use UDP. The UDP header header is shorter then the TCP header however. It still has source and destination numbers, and a checksum, but besides that, that's about all. No sequence number since it is'nt needed. Generally, UDP is used by the protocols that handle name lookups, and a number of similar protocols. Basically UDP packets can only be used as a malicious attack if sent in large quantities at a fast rate. However, don't underestimate UDP attacks. If a malicious user UDP floods you with giant UDP packets at a fast speed you'll feel the effect and most likely need to reboot, or at least a connection drop unless the right protection is being used. =-ProtectioN-= Firewalls are the only protection program I have seen that will block UDP floods, although I am sure there are other utilities that handle them. =-OS(s) EffecteD-= All Windows platforms and many other OSs, even such UNIX flavors will lag if hit right with a mass UDP flood. =-AdditionaL NotE-= UDP2, UDPstorm and other programs will execute this attack. o0o0o0o0o0o0o0o0o0o0o0o0o0o0o0 *TCP TCP, otherwise known as TransmissionControlProtocol, is responsible for breaking up messages into packets, and reassembling them properly. However in many applications, there are messages that will fit into a single packet. EX name lookup. When a user attempts to make a connection to another system, he will generally specify the system by name, rather then internet address. Well, his system has to translate that name to an address before it can do anything. Generally, only a few systems have the database used to translate names to addresses, so the users system will have to send a query to one of the systems that has the database. This query is going to be very short and will certainly fit into one packet, as will the answer. Thus it seems dumb to use TCP, but of course TCP does more then just break up things into packets. For instance, it also makes sure the data arrives, resending packets where necessary. But for a question that fits into a single packet, we don't need all the complexity of TCP to do this. If we don't get an answer after a few seconds, we can just ask again. For applications like this, there are alternative to TCP, such as the above two protocols. But, how can TCP be used in an aggressive manner? Well, as all packets it can be flooded with. For instance, you can flood a host with various TCP requests. At a fast rate this is a very dangerous attack. =-ProtectioN-= Firewalls, of course, protect from TCP floods.Other then that various programs protect from TCP flooding. =-OS(s) EffecteD-= All Windows platforms are harmed to some point from TCP floods. All UNIX flavors are effected in some way, whether it be lag or connection drop, or even reboot depending on security level, I believe. =-AdditionaL NotE-= I'm afraid I have seen no TCP flooders other then maybe port fuck, which connects to ports thro TCP and disconnects, then repeats, for Windows. However, Linux has many various .c exploits that are capable of TCP attacking. *OveralL Overall, if one machine can communicate to another in whatever way there is an attack for it. Has it not been invented yet, it will be shortly. For instance, even chat programs can be a way of DoS. Just look at ICQ. IRC. Almost all types of email can be attacked using exploits to gain root, or mailbombing it, ect. However, a lot of attacks are'nt really attacks. They are programs that exploit a bug in a machine. You can't really consider that a malicious attack, as it was only done because the victems mistake. Such as OOB "attacks" to windows, (winnuke) is'nt really, an attack if you look at it this way- Windows has a bug. What did the attacker do other then exploit it? Nothing really. In this case get a flavor of UNIX, the most bug free OS. o0o0o0o0o0o0o0o0o0o0o0o0o0o0o0 *OOB OOB, otherwise known as OutOfBand, is dangerous because very little has to be done to get a very big effect. By sending OOB data to port 139 on WinNT can causea BSOD with a stop 0xA error in tcp.sys. And all you need is a connection to that socket. The source is rather simple, a connect to the socket followed by a send with the MSG_OOB flag set. Of course, Win95 is vulnerable to the same problem except that it does'nt crash, but does lose networking. The complexity of this however is quite simple in that there are programs such as winnuke that require only you enter an IP and click "nuke". Well, with a simple bug comes a simple answer witch is a patch/fix known as "oob fix" that can be found almost anywhere. =-ProtectioN-= The patch/fix is the only thing you need. But there are also seperate progs that watch port 139 for OOB attacks. Firewalls catch these as well. =-OS(s) EffecteD-= Win95 and WinNT are effected as explained above. =-AdditionaL NotE-= Winnuke and other various nuking progs exploit the OOB bug in Windows although it's close to impossible to find someone without protection for it anymore. /\/\/-> ProtectioN <-\/\/\ --TypeS-- *Firewalls There are two types of firewalls, the physical internet type where an actual IP is blocking you, and the desktop type such as Conceal Signal 9 for Windows that monitors all incomming material that may be considered dangerous. Firewalls can come in handy when blocking attacking obviously, but also when someone trys gathering information on your machine, such as finger may be blocked, and portscanning may be blocked, ect. I believe this is the best protection you can have. *SpoofinG There are many different ways to spoof. There are programs that spoof, exploits, many UNIX utilities, wingating, bouncing, proxy servers, ect. Call it what you'd like, its all generally the same. Bouncing is where you literally bounce information off of another host to yours changing your info to that hosts info. there are bouncing progs but you can bounce servers without progs and with a little knowledge. Proxy servers/Wingating servers are used to bounce off of too. You can bounce off of a proxy server when FTPing, among other things. Wingating s mainly used when using mIRC. You can even use proxy servers when surfing the net. Finding wingate servers however is a little more complex, although we won't go into that in this text. Programs that spoof usually won't work, exploits are more reliable, and UNIX utlities are most reliable. Experiment. *SinglE ProgramS There are many programs that block just one thing, such as ICMP floods, OOBs, UDPs, TCPs, ect. There are also certain programs that will block all attacks. Although not as good as firewalls they are the next best thing. NinX port blocker is a nice prog that allows you to block a single port from attacks, for Windows. Many exploits for UNIX flavors block attacks. Look around. *SkillS There are of course certain tricks in monitoring your system if you have the skills. Let me warn you, if you do not fully understand what you are doing don't mess around as you can crash your system for good and have to re-install. *PatcheS Referring to above as I said some "attacks" are'nt really attacks, as they exploit faults in another system, there are patches to cover these faults. Windows has the well known OOB bug where a certain OOB packet is sent to the host (winnnuke) and windows locks up. Well, there is the OOB fix for Windows. There are of course bugs in everything, even in Linux, and thus patches. Once again you'll need to look around. Usually the producer will have the patches at the homepage. If all else fails, the next version of that OS is almost sure to be fixed of these bugs. *OveralL If there is an attack, there is protection. Look at it this way, money hungry people like Bill Gates finds out about the OOB bug in Windows. He can't lose $$$ now can he? So he makes a patch. Or, a many times protection/patches-fixes are made by hackers or un-corperate people that are'nt in it for the money and are just tired of getting attacked. Well, its a giant cycle. There is always bugs in OSs, and every time an OS is released its only a matter of time before hackers find one of the bugs in it. Then a patch/fix comes out for it, and the next version of that platform OS has the bugs fixed. But in the new version comes more bugs, and so on. Get it? Well its the same way with attacks. Pingflooders are released and proven to bring all OSs to thier knees (example). Well protection is quickly made and is included in the next version. But with the next version comes more valnurability to attacks. It keeps going. Anyhow there will always be new attacks to look forward to, more bugs, more protection. Nothing is bug free, in 5 years Windows will still have its faults, ect. Well, you get the idea. *OveR-OveralL* The best thing I can suggest is getting the most bug free OS. Linux 5.1 redhat complete OS at the moment. Next, learn and gain the skills needed to properly monitor your system from possible attacks. Also get a firewall. Use a proxy server to bounce from whenever possible. Spoof whenever possible. As far as attacking goes, just keep on the lookout for the latest attacking utl's. If you're experienced make your own. That's it for now. Watch for the next text BY: |[xHostiLe]| leader of CYbER-StrikE I CaN SmelL YouR WickeD RigormortiS A MilE FroM ThE MorguE. ThE ScorN IN YouR SouL MaY TelL YoU TO HumiliatE YouR EnemieS HavE NoT YoU ReaD ThE ArT OF WaR, AbsenT MindeD TO ThE EndurinG, PourinG YouR CuP OF DamnatioN IN ThE MidsT OF MY WorlD YoU GottA BE OuttA YouR MonkeY AsS MinD. NO MorE WilL ThE LooK OF MedusA SeducE ThE PredecessorS AnD EntrepreneurS. Keep it real, keep your sanity (or not), and of course... keep your enemies close. |[xHostiLe]|