2KKUU7ita

152
Part III: Hacking Network Hosts
what everyone was blabbing about on Facebook (oh, the humanity!). Think
about this: When hundreds of millions of people can be taken offline by one
targeted DDoS attack, you can see why understanding the dangers of denial
of service against your business’s systems and applications is important.
DoS and DDoS attacks can be carried out with tools that the attacker either
writes or downloads from the Internet. These are good tools to test your network’s
IPS and firewalls for denial of service weaknesses. You can find programs
that allow actual attacks. Some programs, such as idappcom’s Traffic
IQ Professional (www.idappcom.com), also let you send controlled attacks.
Testing
Denial of service testing is one of the most difficult security checks you can
run. There just aren’t enough of you and your computers to go around. Don’t
fret. You can run a few tests to see where you’re weak. Your first test should
be a search for DoS vulnerabilities from a vulnerability-scanning perspective.
Using vulnerability scanners, such as QualysGuard (www.qualys.com) and
WebInspect (www.hpenterprisesecurity.com/products/hp-fortifysoftware-security-center/hp-webinspect),
you can find missing
patches and configuration weaknesses that can lead to denial of service.
During a recent security assessment project, QualysGuard found a vulnerability
in an older version OpenSSL running on a web server. As with most DoS
findings, I didn’t actually exploit the vulnerability because I didn’t want to
take down the production system. Instead, I listed it as a “medium priority”
vulnerability — an issue that had the potential to be exploited. My client
pushed back and said OpenSSL wasn’t on the system. With permission, I
downloaded the exploit code available on the Internet, compiled it, and ran
it against my client’s server. Sure enough, it took the server offline.
At first, my client thought it was a fluke, but after taking the server offline
again, he bought into the vulnerability. It ended up that he was using an
OpenSSL derivative, hence the vulnerability. Had my client not fixed the
problem, there could have been any number of attackers around the world
taking — and keeping — this production system offline, which could have
been both tricky and time consuming to troubleshoot. Not good for business!
Don’t test for DoS unless you have test systems or can perform controlled
tests with the proper tools. Poorly planned DoS testing is a job search in the
making. It’s like trying to delete data from a network share and hoping that the
access controls in place are going to prevent it.
Other DoS testing tools worth checking out are UDPFlood (www.mcafee.com/
us/downloads/free-tools/udpflood.aspx), Blast (www.mcafee.com/
us/downloads/free-tools/blast.aspx), NetScanTools Pro, and
CommView.