Local Area Networks (LANs) in Aircraft - FTP Directory Listing - FAA

affected by the signal intermittence properties of the underlying wireless media. Should audit
logs be successfully modified to cloak the fact that a router had been compromised within a
mobile environment, then the network managers may have a difficult time determining whether
the routing table fluctuations, for example, were a function of normal mobile network
availability problems due to signal intermittence or whether they had a more sinister origin.
A.4 INTEGRITY AND CONFIDENTIALITY ATTACKS.
Perhaps the most common security threat that historically resulted from compromised routers has
been compromising the confidentiality of the data contained within the packets that the router
forwards. The prevalence of this class of attack is kept well hidden from the public due to
possible detrimental business impacts should the general public learn of this threat type.
However, beginning in 1994, major U.S. Internet service providers began to privately disclose
during IETF meetings certain successful (and extremely clever) exploits of this nature. Because
these types of attacks are not discussed publicly, it is impossible to know just how pervasive and
widespread this problem remains. For it to occur, a successful exploit enables an attacker to
insert a backdoor (for future access to the collected data that may be stored locally in the router
or forwarded elsewhere) into the router’s OS, coupled with an attacker-built, packet-reading
utility that is inserted in the router’s forwarding engine to glean and store (or forward) relevant
information obtained from the router-forwarded packets.
It is also conceivable that if the attacker can insert a clandestine packet-listening program then he
or she could also theoretically insert software to change select packet data, thereby affecting the
integrity of the transmitted data itself. IETF protocols (see section 4.5) come equipped with
integrity provisions to detect and reject malformed results from this latter type of attack. Thus,
integrity attacks are more likely for the subset of communication protocols that have not been
configured to provide integrity protections at the protocol level. Unless such packet corruption
is sparingly done, it is possible that network managers may observe a higher percentage of
message integrity failures, and thus become alerted to this particular activity. In any case, the
best defense for recognizing this type of attack is deploying a network instrusion detection
system (NIDS) capability on the network and ensuring that the NIDS has a highly intelligent
expert system to correctly identify (with the lowest possible percentage of false positives) these
classes of attacks.
However, the first line of defense for protecting network communications from these types of
attacks is to universally use Internet Protocol security. Specifically, the use of the encapsulating
security payload (see RFC 4303) is particularly well-suited for effectively protecting
transmissions against possible integrity and confidentiality attacks.
A-18