Cyber security \ hacking25 Jul 2019 08:23
In the presentation, there is a bit of technical talk about cyber security. Yesterday, Skybox issued a release about risks in Cloud computing and that was quite technical. These two things reminded me of something that has been on my mind for a while..
I believe there is a gap between the transport protocols and the firewall.
Up to now I haven't had the time to investigate this, but how I think this flaw is exploited is that a hacker installs a new network protocol, an impostor, into the protocol stack, in a similar way to how, say, Stream Control Transmission Protocol, SCTP, sits alongside TCP.
In practice, how this flaw is exploited is that the hackers send booby-trapped packets to the target machine. They plant malicious codes in the frame header that confuse the exchange of port numbers during the TCP handshake, so that the packet is assumed to be a network configuration message and the target machine adds a new entry in the protocol table.
To slip it past packet sniffers, they use padding to get over the problem of incorrect checksums and they could confuse the TCP/IP fingerprinting data by running an obfuscator on top of the IP layer, a bit like putting false number plates on a car, to hide their tracks. They can bypass internet filtering by creating a sort-of pipe or tunnel in the same way that it is possible to tunnel SCTP over UDP.
Now that they have inconspicuously installed this impostor into the protocol stack, they have a security pass that lets them in any time. By sending malicious instructions disguised as, say, generic routing encapsulation data, they can run remote procedure calls using the newly registered port numbers and use these RPCs to install rogue implants onto the target machine, then those implants can then write to files, edit the data and corrupt the logs.
Hackers can force their malware on to any target machine and they don't need some user to unwittingly click on a link to install it. They are like unstoppable gatecrashers.
Imagine what they could do to financial accounts if they got that kind of control over computers in banks, large companies or the Treasury and other government departments. They could create economic catastrophe that would destroy the country.
Sensational isn't it, but is is realistic -
There are vulnerabilities in the SCTP packet structure. The ECNE chunk and the CWR chunk in the SCTP payload are not defined by the RFC, so can they be hijacked to create an impostor protocol.
From - https://en.wikipedia.org/wiki/SCTP_packet_structure -
"ECNE chunk
Not defined yet.
CWR chunk
Not defined yet. "
That is what they slip in the rogue code.
The techno-thriller, "The Perdix Project" by Teddy Tunstall, has astrophysics, quantum physics, hacking and cyber crime, mystery, action, detection, clues and logical deduction and a few touches of humour.
--- I hit the limit on the number of characters allowed, please see the next message --
Sign In
Follow the stocks
