Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

force mechanisms can be defended against by effective password management procedures and
by limiting the number of failing account accesses that can occur within a given time period.
The other types of attacks will be discussed below.
A.2.3 OPEN-NETWORK PORTS.
Ports 11 provide the avenue for device processes or applications to receive or send data across an
IP network. IP communications are addressed in terms of a specific IP address that identifies a
specific device within the network, and a specific port, identifying a specific application or
process within that device (see RFC 2780). Open ports within a device provide opportunities for
remote attackers to remotely attack the process or application using that port. All unneeded ports
should to be closed. Indeed, devices should only support the minimum number of ports required
to perform the device’s mission(s). Bob Toxen observed:
“Just as every account on a system is a potential path for a cracker, every network
service [port] is a road to it. Most Linux [i.e., a type of Unix] distributions install
‘tons’ of software and services by default. They deliberately prefer ‘easy’ over
‘secure.’ Many of these are not necessary or wanted. Take the time to remove
software and services you do not need. Better still—do not install them to begin
with.” [A-10]
For example, Department of Defense (DoD) instruction 8551.1 [A-11] requires that
“Ports, protocols, and services that are visible to DoD-managed network
components shall undergo a vulnerability assessment; be assigned to an assurance
category; be appropriately registered; be regulated based on their potential to
cause damage to DoD operations and interests if used maliciously; and be limited
to only the PPS required to conduct official business or required to address
Quality of Life issues authorized by competent authority.” (Emphasis added,
quoted from Section 4.1 of A-11.)
A.2.4 OLD SOFTWARE VERSIONS.
Vulnerabilities are continually being found and corrected in software systems. Thus, effective
security requires that the administrators keep up with the current patches and software versions.
A.2.5 SESSION HIJACKING.
Session hijacking is the process used by an attacker to find an active TCP connection between
two other computers and to take control of it, making it unusable by the actual source. Hacker
tools, such as juggernaut and hunt, seek to leverage this vulnerability.
A.2.6 WEB HACKING.
Websites are subject to a host of security vulnerabilities that offer attackers numerous possible
11 See http://www.iana.org/assignments/port-numbers
A-7