Detecting Device-Based Attacks

In the previous chapter, we learned about network-based attacks in which the attacker targets communications lines, and how to protect against them. In this chapter, we talk about attacks targeting network devices and how to harden your network devices against these attacks. By the end of this chapter, you will understand the risks to communications devices and learn how to protect against these risks.

In network devices, we focus on devices that are used for packet switching and forwarding, from simple Layer 2 switches, routers, firewalls, and load balancers to other devices that receive and send packets through the network.

This chapter starts with an explanation of the structure of communications devices— the management, control, and forwarding planes—then, we will drill down into each one, learn about the device resources assigned to each one of them, and learn about the risks and how to protect against them.

In this chapter...

Network devices' structure and components

In this section, we talk about the functional and physical structure of communications devices. We start with the functional structure.

The functional structure of communications devices

As we saw in Chapter 1, Data Centers and the Enterprise Network Architecture and its Components, in the Data, control, and management planes section, a communications device's structure comprises three planes, categorized by the function they perform, as follows:

• A management plane that enables the administrator or the management system to give commands and read information from the device
• A control plane that makes decisions as to where to forward the data
• A forwarding or data plane that is responsible for forwarding the data

As there are three different functions, there are also three different ways to attack a device, as outlined here:

• Attacks on the management plane will be attacks trying to breach passwords...

Attacks on the management plane and how to defend against them

The management plane is the part of the device responsible for controlling the device—that is, to log in to the device and configure it, to receive SNMP commands, to send SNMP traps and System Logging Protocol (Syslog) messages to a management console, and so on.

For this reason, attacks on the management plane can be categorized as follows.

The first sorts of attacks are brute-force attacks for password discovery, such as the following:

• Brute-force attacks for password discovery—Telnet, Secure Shell (SSH)
• Brute-force attacks against SNMP passwords (community strings)
• Brute-force attacks against HyperText Transfer Protocol (HTTP)/HTTP Secure (HTTPS) passwords
• Brute-force attacks on proprietary-access applications

The next kinds of attacks are attacks on the management plane intended to interfere with the management of the device. In this category, we have the following:

...

Attacks on the control plane and how to defend against them

The control plane, as we saw earlier in this chapter, contains the protocols and processes that communicate between network devices in order to move packets from end to end through the network. In this category, we have Layer 2 protocols such as the Spanning Tree Protocol (STP)/Rapid STP (RSTP); Layer 3 routing protocols that learn network topologies such as the Cisco Discovery Protocol (CDP) or the Link Layer Discovery Protocol (LLDP) that advertise equipment information to their neighbors; the Resource Reservation Protocol (RSVP) that establishes a guaranteed end-to-end (E2E) channel with pre-defined QoS; the Internet Control Message Protocol (ICMP) that is used for network reachability testing; and others.

In Chapter 10, Discovering LAN, IP, and TCP/UDP-Based Attacks, and in Chapter 12, Attacking Routing Protocols, we will get into the details of how to protect the network protocols themselves. What we talk about in...

Attacks on the data plane and how to defend against them

As we saw earlier, the data plane is the part of the networking device that's responsible for the transfer of data through the device, and therefore attacks on the data plane are those targeting processes and services that are responsible for data transfer. Data plane services are services such as ICMP, ARP, and Reverse ARP (RARP), among others. We will go through these services and see how to protect the data plane while using them.

Protection against heavy traffic through an interface

Heavy traffic can cross a networking device interface—that's the purpose of it. The thing is to know when it happens and check if it is legitimate traffic. For this purpose, there are two things we can configure, as follows:

• Traffic threshold
• Storm control

Configuring a threshold: 80-90% of the interface bandwidth should be a reasonable value. For example, for Cisco, refer to https://www.cisco.com/c/en...

Attacks on system resources

A communications device is a dedicated computer, and this computer has computer resources that can be attacked. In this section, we talk about potential attacks on these resources and how we can protect against them.

Memory-based attacks, memory leaks, and buffer overflows

Memory leaks are static or dynamic memory resource allocations of memory that do not serve any useful purpose. This can be due to a software bug, inefficient software, or attacks that consume memory resources.

Memory-based attacks and causes of memory leaks

Memory leaks can be any of the following:

• An application that continually stores data in memory, without releasing the memory for other applications.
• An inefficient application that locks a large amount of memory without a real need for it, prohibiting other applications from accessing this part of the memory.
• An attack on device resources that consume a large number of memory resources. This can be anything...

Summary

In this chapter, we talked about risks to networking devices, including attacks on the management, control, and data planes—attacks on the management plane that intend to break into devices or prevent us from managing them, attacks on the control plane that target the protocols that a device works with, and attacks on the data plane that forward the information. We also talked about attacks on device resources and how to discover and protect against them.

Now that you have completed this chapter, you will be able to protect your communications devices against various attacks targeting the management, control, and forwarding planes, and set notifications for such attacks when they happen.

In the next chapter, we will talk about eavesdropping, packet analysis, and behavior analysis, and then go on to how to defend against attacks on the network protocols, getting deeper into identifying and protecting our network.

Questions

1. Attacks on the control plane are targeting:
   1. The data that is transferred through the device
   2. The device control information that is transferred through it
   3. Communication protocols that are used for transferring information through the device
   4. The management of the device
2. A brute-force attack is an attack that:
   1. Generates a large amount of traffic in order to crash the target
   2. Uses password-guessing mechanisms in order to break into a device
   3. Brutally blocks access to a communications device
   4. Simultaneously attacks the control and management planes
3. You should configure SNMPv3 on your network devices:
   1. Always—SNMPv3 is the highest security version and therefore should always be configured.
   2. It depends on the level of security that is required and the risks you are subjected to.
   3. Only for the protection of the management plane
   4. Only for the protection of the control plane
4. SYN attacks are attacks that are:
   1. Generated in order to scan a network device for open TCP ports
   2. Generated...