Tools to Counter a Hack Attack

Ensuring information security for your datacenter is a crucial and  difficult
task. To protect data, organizations follow several security practices which at
times cost them millions. Several open source tools provide available today
provide economic and reliable way to monitor your network in real time and
prevent hacking. The security of a  network depends largely on how it is
implemented and even if the system or network is properly implemented there
remains possibilities of some vulnerabilities  residing on them. The security
encroachers exploit those vulnerabilities and get access into the system. There
are several ways  hackers exploit these vulnerabilities. They scan for open
ports and services with weak security and eventually make their way to  the
network.  They attack the network by DoS, DDoS and SYN attacks.  The reality is,
no matter how stringent are your security practices,  newer and sophisticated
attacks will always keep peeping into it. So what do you do when a relentless
hacker  surpasses all your security gates and find out a way to  make all
operations come to a standstill? How to figure out which systems are being
attacked and  what possible ways can help you stop him. Here we talk about some
open source tools which will help you  get a real time scenario of  what  goes
on inside a network and how can you misguide a hacker during an active scan.

ArpAlert results which show IP address on which attack is launched and IP address of the machine from which the attack was launched.

This shows that there is a flip flop in the Mac address . It also shows IP address of the targeted machine.

The Mac address of the machine being spoofed and the replaced Mac address.

ArpAlert -Watch who is connecting to your network

One of the best ways to keep an eye on the network for any malicious
activity is monitoring it continuously. While many sniffers show you the details
of previous logs, there is a need of real time sniffer to know what is happening
in the network at a moment. ArpAlert uses ARP address monitoring to help detect
unauthorized connections on local network. It listens on the network interface
and catches all  Mac  to IP address conversation. It compares those scanned Mac
addresses with the authorized Mac addresses and  displays on the screen if any
inconsistency is found. It detect IP  spoofing within the network and shows
which address is being spoofed. It also shows which machine in the network is
trying to spoof. We ran an IP Spoof test on one of the machines and
simultaneously started ArpAlert on the monitoring machine. ArpAlert found an IP
Spoofing within the network at once and the information started coming out on
the monitor screen. To launch an ARP Spoof attack, we used a utility called
arpspoof. To use arpspoof, go to terminal and type  arpspoof  -i eth0  target
ipaddress. We then started ArpAlert on the monitoring machine and it started
showing the results on the monitor.

The Mac address of the machine being spoofed and the replaced Mac address.

The Labrea shows IP address of fake machine being scanned and IP address of machine which has launched scan.

Arpwatch

 It is another open source real time sniffer which helps you know about the
ongoing activity on your network and even sends you mail if it detects any
suspicious activity on the network. It simultaneously sends alerts to syslog.
This is helpful in the shared network using a hub where a single machine can
monitor the network. Arpwatch monitors the activity on the network and keeps a
database of the Ethernet/IP pairings. It keeps you informed every time a machine
gets a new IP address. It emails  the current IP address the machine  is leasing
and the Mac address.  It can run on almost all Linux distributions. Arpwatch
uses a system independent interface called libcap for user level packet capture.

You need to install libcap prior to installing Arpwatch and it is necessary
that Arpwatch and libpcap are installed in the same directory. Arpsnmp is a
package which is similar to Arpwatch but does not require libcap for its
operation. It uses SNMP to collect IP to Mac address mappings.  You can get
reports about new Ethernet address or any change in the currently assigned
Ethernet address. To start Arpwatch, just go to the terminal and type arpwatch -i
eth0 and it will start listening and recording the data and sending into your
mail. Also you can see the results in /var/log/messages directory. Use command
tail -f  /var/log/messages to see the results. We tested this tool on our local
network by arp spoofing a machine and waited for Arpwatch logs.

The image shows the Nmap results which show about 50 open ports on the machine which actually don't exist

Labrea

Labrea helps you deceive the hacker by creating virtual servers with lots of
open ports which may lure a hacker. And if  he is planning a DoS attack on your
network , he will be diverted by the nonexistent servers . Basically it uses all
unused IP addresses and creates false virtual servers. So when an attacker
attacks the network he will see lot of open and vulnerable ports to play with .
With this, you can easily divert a DoS attack from your network. To use Labrea
on your machine, use the command labrea -o -v -z.  Labrea sniffs for TCP/IP
traffic sent to that MAC address & then responds to any SYN packet with a SYN/ACK
packet that it creates. It also shows information about the source address of
attacker.

To test Labrea, we first tried to ping an unused IP on our network. For the
first three seconds the screen showed a message 'Request time out', however
after three seconds the response started coming out. We then started a Nmap port
scan and it showed about 50 open ports on the machine.