Because of the sheer size of the internet and the many security issues and vulnerabilities that have been published, opportunistic attackers will continue to scour the public IP address space for vulnerable hosts. The combination of new vulnerabilities exposed daily and IPv6 adoption allow opportunistic attackers to always compromise a certain percentage of Internet networks.
Classification of Internet-Based Attackers
At a high level, Internet-based attackers can be divided into two groups:
network security assessment
Opportunistic attackers scan large Internet address spaces for vulnerable systems
Concentrated attackers who attack specific Internet-based systems with a specific target in mind
Opportunistic threats involve attackers using persistent, automated rooting tools and scripts to compromise vulnerable systems on the Internet. Public Internet researchers have found that after deploying a vulnerable, basic-ready server setup, it is typically compromised within an hour by automated software running in this way.
Most Internet hosts compromised by opportunistic attackers are unsecured home user systems. These systems then turn into zombies running software, logging user keystrokes, launching denial of service (DoS) flood attacks, and acting as a platform to attack and compromise other systems and networks.
Concentrated attackers take a more complex and systematic approach with a clear goal in mind. A focused attacker thoroughly probes each entry point into the target network, port scans each IP address, and thoroughly evaluates each network service. This resolute attacker knows his weakness, even if he cannot compromise the target network on the first attempt. Having detailed knowledge of the site's operating system and network services could allow an attacker to release new attack scripts in the future to compromise the network.
The most at-risk networks are those with a large number of public hosts. Having many entry points in the network increases the potential for compromise and as the network grows, risk management becomes increasingly difficult. This is commonly known as the defender's dilemma. Defenders must ensure the integrity of each entry point, whereas attackers only need access from one point to be successful.
Assessment Service Description
Security vendors offer a variety of assessment services that are branded in different ways. Figure 1-1 shows key service offerings with in-depth assessments and relative costs. Each type of service can provide different levels of security assurance.
Various security testing services
Figure 1-1. Various security testing services
Vulnerability scans use automated systems (eg Nessus, ISS Internet Scanner, QualysGuard or eEye Retina) with minimal hands-on proficiency and vulnerability assessment. This is an inexpensive way to ensure that obvious vulnerabilities are not discovered, but it does not provide a clear strategy for improving security.
Network security assessment is an effective combination of automated and real manual vulnerability testing and validation. Reports are often hand-written, accurate and concise, providing practical advice that can improve your company's security.
Web application testing includes post-authentication evaluation of web application components, command injection, and identification of weak privileges and other weaknesses in specific web applications. Testing at this level involves extensive manual competencies and consultant engagement and cannot be easily automated.
Complete penetration testing is beyond the scope of this book. It contains multiple attack vectors (such as phone combat calls, social engineering, and wireless testing) to damage the target environment. Instead, this book fully describes and explains the methodology employed by Internet-based attackers to remotely compromise IP networks. This can improve IP network security.
On-site inspections provide the clearest picture of network security. Advisor has local system access and execution tools that can identify everything undesirable on each system, including rootkits, weak user passwords, insufficient privileges, and other issues. 802.11 wireless testing is typically performed as part of an on-site audit. Field inspections are also outside the scope of this book.
