Tools to Counter a Hack Attack

Ensuring information security for your datacenter is a crucial and  difficult

task. To protect data, organizations follow several security practices which at

times cost them millions. Several open source tools provide available today

provide economic and reliable way to monitor your network in real time and

prevent hacking. The security of a  network depends largely on how it is

implemented and even if the system or network is properly implemented there

remains possibilities of some vulnerabilities  residing on them. The security

encroachers exploit those vulnerabilities and get access into the system. There

are several ways  hackers exploit these vulnerabilities. They scan for open

ports and services with weak security and eventually make their way to  the

network.  They attack the network by DoS, DDoS and SYN attacks.  The reality is,

no matter how stringent are your security practices,  newer and sophisticated

attacks will always keep peeping into it. So what do you do when a relentless

hacker  surpasses all your security gates and find out a way to  make all

operations come to a standstill? How to figure out which systems are being

attacked and  what possible ways can help you stop him. Here we talk about some

open source tools which will help you  get a real time scenario of  what  goes

on inside a network and how can you misguide a hacker during an active scan.

ArpAlert results which show IP address on which attack is launched and IP address of the machine from which the attack was launched.

This shows that there is a flip flop in the Mac address . It also shows IP address of the targeted machine.

The Mac address of the machine being spoofed and the replaced Mac address.

ArpAlert -Watch who is connecting to your network



One of the best ways to keep an eye on the network for any malicious

activity is monitoring it continuously. While many sniffers show you the details

of previous logs, there is a need of real time sniffer to know what is happening

in the network at a moment. ArpAlert uses ARP address monitoring to help detect

unauthorized connections on local network. It listens on the network interface

and catches all  Mac  to IP address conversation. It compares those scanned Mac

addresses with the authorized Mac addresses and  displays on the screen if any

inconsistency is found. It detect IP  spoofing within the network and shows

which address is being spoofed. It also shows which machine in the network is

trying to spoof. We ran an IP Spoof test on one of the machines and

simultaneously started ArpAlert on the monitoring machine. ArpAlert found an IP

Spoofing within the network at once and the information started coming out on

the monitor screen. To launch an ARP Spoof attack, we used a utility called

arpspoof. To use arpspoof, go to terminal and type  arpspoof  -i eth0  target

ipaddress. We then started ArpAlert on the monitoring machine and it started

showing the results on the monitor.

The Mac address of the machine being spoofed and the replaced Mac address.

The Labrea shows IP address of fake machine being scanned and IP address of machine which has launched scan.

Arpwatch



 It is another open source real time sniffer which helps you know about the

ongoing activity on your network and even sends you mail if it detects any

suspicious activity on the network. It simultaneously sends alerts to syslog.

This is helpful in the shared network using a hub where a single machine can

monitor the network. Arpwatch monitors the activity on the network and keeps a

database of the Ethernet/IP pairings. It keeps you informed every time a machine

gets a new IP address. It emails  the current IP address the machine  is leasing

and the Mac address.  It can run on almost all Linux distributions. Arpwatch

uses a system independent interface called libcap for user level packet capture.

You need to install libcap prior to installing Arpwatch and it is necessary

that Arpwatch and libpcap are installed in the same directory. Arpsnmp is a

package which is similar to Arpwatch but does not require libcap for its

operation. It uses SNMP to collect IP to Mac address mappings.  You can get

reports about new Ethernet address or any change in the currently assigned

Ethernet address. To start Arpwatch, just go to the terminal and type arpwatch -i

eth0 and it will start listening and recording the data and sending into your

mail. Also you can see the results in /var/log/messages directory. Use command

tail -f  /var/log/messages to see the results. We tested this tool on our local

network by arp spoofing a machine and waited for Arpwatch logs.

The image shows the Nmap results which show about 50 open ports on the machine which actually don't exist

Labrea



Labrea helps you deceive the hacker by creating virtual servers with lots of
open ports which may lure a hacker. And if  he is planning a DoS attack on your

network , he will be diverted by the nonexistent servers . Basically it uses all

unused IP addresses and creates false virtual servers. So when an attacker

attacks the network he will see lot of open and vulnerable ports to play with .

With this, you can easily divert a DoS attack from your network. To use Labrea

on your machine, use the command labrea -o -v -z.  Labrea sniffs for TCP/IP

traffic sent to that MAC address & then responds to any SYN packet with a SYN/ACK

packet that it creates. It also shows information about the source address of

attacker.

To test Labrea, we first tried to ping an unused IP on our network. For the

first three seconds the screen showed a message 'Request time out', however

after three seconds the response started coming out. We then started a Nmap port

scan and it showed about 50 open ports on the machine.