Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

information found within these databases is public and serve as the “white pages phone book”
for the worldwide Internet community.
The DNS is also an important component of the Internet’s infrastructure. DNS is a hierarchical
database distributed around the world that stores a variety of information, including IP addresses,
domain names, and mail server information. DNS entries normally contain a great deal of
information relevant to the attacker, including the registrant’s name, the domain name, the
administrative contact, when a record was created and updated, and the DNS servers within that
domain. Using a process called “resolving,” users and programs search the DNS hierarchy for
information about given domain names. A list of dynamic host configuration protocol (DHCP)
servers, e-mail servers, major file servers, major database servers, and other key system services
is potentially available from DNS zone information, should the attacker eventually be able to
access it 4 . These lists will normally include relevant information such as their IP addresses and
DNS names of devices supporting essential infrastructure services of the target deployment.
This information can be followed up in subsequent network queries, point-of-contact queries,
and other mechanisms to subsequently learn increasing detail about these key devices within the
target environment.
During this investigation, the attacker will also be looking for serious but far-too-common
configuration mistakes, such as allowing untrusted users to perform DNS zone transfers. Should
such a vulnerability exist, it can easily be exploited through nslookup and other means.
The explicit goal of the attacker at this stage is to learn as much as possible about the target
organization, the domain, and network infrastructures to be attacked. This explicitly includes
point of contact information that is very useful for many classes of social attacks. Most
importantly, the attacker seeks to construct an accurate network map of the target environment,
including an accurate classification of the operating systems (OS) and applications residing
within both the routers and computers within the target environment, as well as their IP
addresses and DNS names (if appropriate). Such information will be useful to maximize the
efficiency and potency of the subsequent attacks.
A.1.2 NETWORK RECONNAISSANCE.
Once network enumeration has become somewhat complete, the attacker will usually attempt to
determine the actual network topology as well as potential access paths into the network from
the attacker’s current location(s). On thoroughly mobile environments such as aircraft in flight,
this information may prove to be largely transient in nature. During this stage, the attacker is
likely to use tools, such as traceroute, since it directly aids in the construction of network
diagrams. Other less useful tools, like ping, may also be employed.
One of the more useful historic general-purpose hacker tools for doing network enumeration and
network reconnaissance is Sam Spade 5 . Many freely available web-based reconnaissance tools
4 Organizations can use a technique called “Split-Horizon DNS” to reduce this threat. This technique maintains
substantially more information about the local deployment on local private DNS servers than the externally
accessible public DNS servers.
5 see http://preview.samspade.org/ssw
A-2