Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

APPENDIX A—HISTORIC ATTACK MECHANISMS AND TOOLS
The following sections contain technical details about historic attack mechanisms and tools that
identify and exploit latent bugs within commercial off-the-shelf (COTS) computing and network
systems [A-1 through A-8]. These mechanisms are not fully explained for non-information
assurance (IA) security personnel, since an explanation of these details was outside of the scope
of this research. Rather, these details provide partial evidence of the fact that the vast majority
of modern computing equipment deployed within Internet protocol (IP) networks today cannot
be adequately secured in general. Specifically, their security provisions, including their trusted
paths and security controls, have repeatedly been demonstrated to not be viable when attacked.
This point was initially mentioned in section 4.3 and then more fully discussed in section 4.4 of
this report.
A.1 FINGERPRINTING (MAPPING AND TARGET ACQUISITION).
Fingerprinting is traditionally the first stage of an attack against IP-based systems. The goal of
fingerprinting is to enable attackers to create a profile of the system and devices that they seek to
eventually attack, including determining their relative security posture and defenses.
The earliest stage of fingerprinting consists of gathering whatever information one can about the
target deployment and the technologies it uses. Increasingly web sites are providing an
incredible wealth of information that can be used by attackers. For example, attackers frequently
do web searches for network links to the target organization. E-mail messages originating from
within the target environment, notably including the simple mail transfer protocol’s (SMTP)
e-mail headers, also contain much useful information about the target environment. Finally,
news groups often reveal a surprising amount of information that is directly relevant to an
attacker.
A.1.1 NETWORK ENUMERATION.
Attackers will seek to obtain information about domain names and the associated networks of the
target deployment to learn about the networks within those environments. Due to
interoperability and connectivity requirements, the target environment may be required to expose
highly relevant domain name system (DNS) zone information to DNS servers elsewhere within
the larger National Airspace System environment. Relevant information may also be available
from whois servers (see section 14).
The American Registry for Internet Numbers database 1 contains information about who owns
particular IP address ranges and given company or domain names. This database can also be
searched to retrieve potentially useful information for domains located within the Americas. The
Reseaux IP Europeens Network Coordination Centre 2 contains similar European information and
the Asia Pacific Network Information Center 3 contains similar Asian information. The
1 ARIN; see www.arin.net/index.shtml
2 RIPE NCC; see www.ripe.net
3 APNIC; see www.apnic.net
A-1