Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

they predate today’s security awareness and therefore their security provisions are
demonstrably inadequate and vulnerable.
• Attacks using the r- services: rsh, rcp, rexec, and rlogin. These services were historically
very popular on Unix systems. Like the ARPA services, these services are designed for
trusted environments only. Unlike ARPA services, they often lack security provisions
altogether.
• Remote attacks by RPC services. These types of attacks either leverage buffer overflow
problems within the RPC implementations itself or else leverage security weaknesses
associated with the Sun Microsystems ONC protocol family services (e.g., Sun RPC,
NFS, Network information systems).
• NFS, mountd, and portmap attacks.
• Leveraging X-windows insecurities.
A.2.13
SOCIAL ENGINEERING.
These attacks involve an attacker tricking a network manager to inappropriately reveal sensitive
information, such as account-password information. As Ed Skoudis observed:
“The most frustrating aspect of social engineering attacks for security
professionals is that such attacks are nearly always successful. By pretending to
be another employee, a customer, or supplier, the attacker attempts to manipulate
the target person to divulge some of the organization’s secrets. Social
engineering is deception, pure and simple” [A-2].
One of the first steps an attacker often takes after compromising a device is to eliminate any
record of his actions from the cracked device’s audit logs and take steps to ensure that none of
his future clandestine actions will be similarly recorded on the audit logs. In standard computer
systems, the former is usually fairly straightforward and consists of modifying, corrupting, or
deleting the audit files themselves.
The attacker usually inserts Trojan horses in key system utilities as a mechanism to hide his or
her activities from the audit logs. He also will establish backdoors and logic bombs for
continued control of the device after he “logs off.”
A Trojan, which is short for Trojan horse, is a program that purports to perform an authorized
task, but actually carries on other activities behind the scenes. Many attackers replace common
OS commands on the cracked OS with Trojans of their own design. For example, ps, netstat,
ifconfig, killall, ls, ssh, who, find, du, df, sync, reboot, halt, and shutdown are commonly
replaced by attackers of Unix OSs by a Trojan version contained within the attacker’s rootkit. A
rootkit is a collection of tools an attacker downloads to a victim computer after gaining initial
access. In addition to system binaries, rootkits for Unix systems usually also contain network
A-11