427 Botnet fm qxd

www.syngress.com
152
Chapter 5 • Botnet Detection: Tools and Techniques
427_Botnet_05.qxd 1/9/07 9:59 AM Page 152

---

(http://blogs.msdn.com/larryosterman/archive/2006/02/02/523259.aspx),
Larry Osterman took a rather humorous slant on this in comparing a DMZ
firewall to the French Maginot Line in World War II.The French built a great
defense wall to keep the Germans out. Unfortunately, the Germans simply
drove north around it.The lesson is that it is reasonable to consider defense in
depth for hosts within a firewall enclave.These techniques can include host
firewalls and cryptographic protocols.They can also include Layer 2 tech-
niques as one more form of defense in depth.The good news about Layer 2
techniques is that they are not per host but can be centrally administered by a
network engineer.
Malware spread via botnets or other means could choose to launch
attacks, including:
■
ARP spoofing
This is especially useful in the case where an
attacking host on a local subnet chooses to masquerade as the router
to allow it to view or change packets from the attacked host to the
rest of the network.
■
Switch table flooding with the common goal of password
sniffing
Put another way, the defeat of traditional Unicast segmenta-
tion in an Ethernet switch means that the host running the packet
sniffer might be able to see packets (especially plain-text passwords)
that it might not otherwise be able to observe.
■
DHCP attacks
For example, an attacking system might simply
intercept DHCP requests and substitute itself as the local router. In
addition to ARP spoofing, this could be another form of MITM
attack.
This is not an exhaustive list of Layer 2 attacks, but we will confine our-
selves to this list for the time being, since the first two scenarios are more
common in our experience.
So, do the good guys have any tricks up their sleeves? Yes, a few.The tricks
can be divided into two categories: switch configuration, which must rely on
vendor features, and infrastructure tricks, which hopefully can be done by any
network engineer with most hardware.