Show description

Antispoofing measures, such as RFC 2827 filtering, prevent hackers from masking their identities. RFC 2827 filtering blocks outbound traffic that has a source address which isn't a valid IP address within an organization's address range. Limiting the number of embryonic, or half-open, connections that are allowed at any given time can also limit the effects of DoS and DDoS attacks. Finally, traffic ratelimiting measures such as limitations on the amount and source of Internet Control Message Protocol (ICMP) traffic can hinder the effects of DoS attacks.

4 describes man-in-the-middle attacks, lists examples, and provides ways to mitigate the risks of these types of attacks. 4. Man-in-the-Middle Attacks Include Example Mitigation Data theft or corruption Session hijacking Traffic analysis A systems integration consultant using a packet sniffer to analyze traffic from a specific host computer Data encryption neutralizes a man-in-the-middle attack by rendering the traffic meaningless to the attacker. Application Layer Attacks Application attacks take advantage of Layer 7 vulnerabilities, such as FTP, sendmail, HTTP, and PostScript, and typically use well-known ports to traverse a firewall.

Obviously, this technique requires that the attacker establish a secure encrypted session with its target host. Obfuscation Obfuscation, an increasingly popular evasive technique, involves concealing an attack with special characters. It can use control characters such as the space, tab, backspace, and Delete. Also, the technique might represent 48 49 characters in hex format to elude the IDS. Using Unicode representation, where each character has a unique value regardless of the platform, program, or language, is also an effective way to evade IDSs.