How can TCAP and UDP protocols be used in an attack targeting remote computer systems
in one of the previous modules we discussed an attack method called the idle scan scan uses zombie machines
which provide the attacker with IP address sequences.
This is one of the vulnerabilities of the fourth layer.
If the sequence is predictable in many computer systems the numbers grow incrementally.
You can first send the packet to the zombie and then you can send the packets to the computer you want
to scan using IP addresses of the zombie victim of this scanning exchange communications only with the
zombie whether or not the packet was sent can be deduced from the successive sequential numbers of the
IP protocol.
If the number is higher it means the packet was received and the reset response was sent your documents
did not specify the details of the mechanism that generates the sequential numbers.
It concerns not only IP numbers but also TCAP numbers.
Some years ago a very popular type of attack consisted of terminating a TCAP session.
There were many programs that allowed the attacker to hijack a TCAP session in order to for example
throw someone out of a chat if the attacker had access to the medium and was able to notice that two
machines exchange data in the TCAP session.
The attacker could get the sequential numbers of the packets as we already mentioned.
These numbers are sent to ensure that the delivery is complete if the numbers were sequential.
The attacker could send packets to the target host impersonating the host that initiated the session
the attacker could send.
For example the reset packet.
The result was that the remote computer logged.
Given the user off of a chat session or some other device this problem was solved a long time ago.
None of the modern operating systems use easily predictable sequential numbers.
There are still many mechanisms used to generate those numbers.
Some are better some are worse.
The main threat connected with the fourth layer of the OSA model comes from the possibility to collect
information about the configuration of the remote hosts and services running on them.
This is due to the fact that conventionally certain services always listen on the same ports
are learning which ports are open.
You get to know which services are running on the remote host in a minute you'll see a demonstration
on how you can use this information.
What can you do to get protected against threats connected with the Protocols of the third layer of
the Esai model you can employ two elements of a general computer system security strategy limit the
risk affected area.
The first way to do so is by blocking ports you don't use the second monitor your network for port scan
attacks.