Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

opportunities to crack the hosting server(s) that supports the web site. So many different
vulnerabilities and exploits are associated with HTTP and web services that it is impossible to
list all of them. Script inadequacies are among the greatest historical vulnerabilities within
websites. This includes problems both within the script itself as well as problems with Common
Gateway Interface (CGI) that interfaces to the scripts or other executables, and with server side
includes (SSI) 12 . Vulnerabilities can also be introduced by inserting malicious code (through
various means) into the user’s web browser or by inserting corrupt web proxies. Many other
security vulnerabilities are introduced by poor web design and programming mistakes on the part
of the web developer, including bugs latent within the executables accessed by the website.
Fortunately, a number of tools have been created to identify specific well-known vulnerabilities
within websites. Older tools include phfscan, cgiscan, grinder, and SiteScan. Unfortunately,
attackers also are able to use these same tools to identify and leverage existing vulnerabilities
within existing web sites, and new vulnerabilities may be inadvertently introduced during any
subsequent web site modification.
A.2.7 MOBILE CODE AND MALICIOUS CODE.
Because the distinction between data and code is vanishing, malicious code (e.g., viruses and
worms) may be introduced without a conscious decision on the part of a user. Malicious code
can perform many functions, including providing a vehicle for an attacker to compromise a
system. For example, malicious code may be introduced when installing executable code, by a
Java applet, or by viewing apparently benign data within received e-mail or at remote websites.
Mobile code, by contrast, is defined to merely be code that travels a network during its lifetime
to execute on a destination machine. All current mechanisms to secure mobile code involves
trade-offs [A-12]. Consequently, the current situation remains very much like Gary McGraw
and Edward Felten observed back in 1998:
“Today’s diverse approaches to securing mobile code are all works in progress.
Each different implementation of mobile code, including Java, ActiveX, and
JavaScript, faces similar security risks; but each system presents a different way
of dealing with the risks. In our opinion, Java's security design stands heads and
shoulders above the competition. But Java is a complex system ... Securing Java
and other forms of mobile code is still as much an art as it is a science” [A-13].
A.2.8 NETWORK TIME PROTOCOL ATTACKS.
Unix devices are potentially susceptible to network time protocol (NTP) spoofing attacks. Even
though the NTP protocol is optionally equipped with authentication and integrity capabilities, it
runs over the UDP protocol. More tellingly, publicly trusted NTP servers rarely use the NTP
authentication provisions. Because of this, it is often possible for an attacker to forge NTP
packets to a machine to make them appear as if they are coming from a trusted NTP server. The
attacker’s goal in doing this is to manipulate that receiving computer’s systems clock, impacting
key utilities on that computer such as cron and ntpdate. A common reason for doing this is that
12 If SSI is used at all, its use should be limited by the “Includes NOEXEC” option.
A-8