Managing Cisco Network Security, Second Edition
A completely updated sourcebook on Cisco Security Management.
TABLE OF CONTENTS Managing Cisco Network Security, Second Edition
Network Hijacking and Modification
Numerous techniques are available for an attacker to "hijack" a wireless network or session. And unlike some attacks, network and security administrators may be unable to tell the difference between the hijacker and a legitimate passenger.
Defining Hijacking
Many tools are available to the network hijacker. These tools are based upon basic implementation issues within almost every network device available today. As TCP/IP packets go through switches, routers, and APs, each device looks at the destination IP address and compares it with the IP addresses it knows to be local. If the address is not in the table, the device hands the packet off to its default gateway.
This table is used to coordinate the IP address with what MAC addresses are local to the device. In many situations, this list is a dynamic list that is built up from traffic that is passing through the device and through Address Resolution Protocol (ARP) notifications from new devices joining the network. There is no authentication or verification that the request received by the device is valid. So a malicious user is able to send messages to routing devices and APs stating that their MAC address is associated with a known IP address. From then on, all traffic that goes through that router destined for the hijacked IP address will be handed off to the hacker's machine.
If the attacker spoofs as the default gateway or a specific host on the network, all machines trying to get to...
Copyright Syngress Publishing, Inc. 2002 under license agreement with Books24x7
