28
More
disconcerting is that banks and other financial institutions are beginning to
implement
security
systems using SMS
systems. Additionally, corporations are beginning to implement
One Time
Password solutions as a method of securing network resources. A One
Time
Password over SMS is a system in which a user
attempts to log into a specific resource by
entering their
username; instead of entering a memorized password, however, the system
forwards a
unique password to their cell phone that is only valid for a short period of
time.
One Time
Passwords are a proven security feature that virtually eliminates social
password
compromises,
but SMS implementations
of the system are fully
compromised if the user’s
cell phone is
stolen, or if an alien machine is snooping for data on the SMS network. As
mentioned
above, snooping a network can allow one to record the login information of other
valid users,
giving the attacker an opportunity to continue their operations at a later time.
• Second,
snooping is often also accomplished by external systems, via Link Hijacking,
along
the data path.
In a TCP/IP network environment, data is routed from its origin to
its
destination by
being transmitted across any number of subnets. As the data is
transmitted
over a link, it is received
by every other device connected to that link, including the next
machine in the
routing sequence for which the data is intended. That machine receives the
data,
identifies from the IP header that the data is intended for it, and then
forwards the data
into a separate
subnet destined for another routing entity. This process continues until it
arrives at the
intended destination device. While network data was received by every
other
device on every
wire along the routing path, these machines typically ignore the data after
determining
from the IP header that they were not intended recipients. These machines
can
be programmed,
however, to record this information. It is a common tactic for hackers to
attempt to
Service Hijack a device along a common route to a service or on a nearby subnet
to the service.
Using these hijacked machines, the attackers would be capable of viewing and
recording data
as it passed into and out of the SMSC. In this case, although the SMSC is
the
actual target
of the attack, the intrusions into the network are done by connecting to other
machines
besides the SMSC, such as the WAP or email gateway service machines.
Encrypted communications alleviates
the majority of concern regarding spoofing, but
dedicated
attackers can also attempt to break the encryption scheme by stealing the keys
if
they are not
well protected.
• And thirdly,
Connection Hijacking is a process in which a snooping machine begins
transmitting
data to a listening machine in an attempt to “convince” that machine that the
data is
actually from an existing valid connection from a third computer. Connection
Hijacking is
especially dangerous because it allows an attacker to wait until an
authorized
connection has
been formed and login account information exchanged before it steals the
connection,
giving it all of the abilities of the previous connection.
Fortunately,
Connection Hijacking is a complex and often computationally heavy operation
and can be
difficult to perform in real-time. First, the attacking machine must be in a
position
to snoop a
connection (it must be connected to the network along the route that a stream of
data from a
source machine and the target would follow). Secondly, if the connection is
encrypted, the
hijacking machine must possess the encryption keys, or it cannot encode and
decode data in
a timely manner. The third criterion is the most difficult: TCP hijacking is
performed by
the attacking machine listening to the data sequence and finding a pattern in
the TCP
identifier field for each packet passing through the stream. If a pattern is
found, the
attacker must
predict a future value of this field and wait until just before the target
machine
would send a
packet with an identical value. At that moment, the machine must begin to