We will now pass up for a moment the issue of physical access to a computer and we'll get to know what
kind of information can be gathered remotely 30 years ago when that working protocols still in use today
were being developed.
Hardly anyone thought about security the first network connected for trusted computers.
When you design a protocol to govern the communication between four computers that run three programs
each and are used by seven people six of whom are your friends.
You don't think much about security.
You don't think how to protect them from DiDio US attacks or data flow tracking.
This is why none of the protocols designed back then TCAP IAP included was designed with security in
mind.
This is very candidly stated in the RAFC architectural document.
If you look up the original RAFC 11:22 document which describes a TCAP protocol you will find that it
ends with the following note.
There are many security issues in the communication layers of hostes software with a full discussion
is beyond the scope of this RAFC.
The problem persists low level protocols do not have any intrinsic security features.
The problem is even more serious because high level protocols rely completely on low level protocols.
High level protocols don't verify or validate the data sent by low level protocols.
Moreover although the RAFC documents contain very detailed descriptions of protocols functions they
lack implementation guidelines.
This led to different implementations of the TZP IP stack people who were responsible for implementation
of the protocols had to make some choices of their own and obviously their choices differed Ethernet
minimum frame size is one example all Ethernet frames must carry a minimum payload.
But what if an operating system wants to transfer less data than the minimum payload.
It has to fill up the frame.
The protocol standard does not specify what to fill up the frame with.
The decision is made by the network card driver.
It turns out that some drivers tend to fill up the frame with random data stored in the memory buffer.
For example a part of the Word document we are currently preparing it is impossible to effectively secure
protocols developed 30 or 40 years ago.
It's difficult to fix that kind of situation because these standards are in constant use
a common practice used to make up for it is to subnet or network
that is to use network switches to split the network into smaller parts.
It is not true that switches are safer than hubs.
Nor is it true that two people connected to different ports at the same switch cannot see the other
transmissions.
There are ways to bypass that solution.
The case is similar with virtual local area networks or volens Lancer's subnets created on a managed
switch.
You need only one managed switch to define multiple subnets users can be grouped in VLAN domains by
ports or MAC addresses in such a networking arrangement.
There must be a system to govern which Ethernet frame enters which port.
This means the VLAN information tag must be inserted into the Internet frame this information is not
in any way secured or encrypted.
Moreover it can be modified in a way that enables tracking of data sent to other lands
attackers exploit security weaknesses in the design of TCAP IP protocol.
Transport layer protocols TZP and UDP reveal much information about the operating system and services
performed by the computer.
This is connected with the issue of scanning remote systems identifying open ports as a method of TCAP
protocols scanning.
We will try to establish a TCAP session but we will only initiate the procedure.
We will send a sin synchronization packet but we won't respond to it.
If we encounter a firewall protect a computer that filters send packets we will try to unexpectedly
end the session and we'll wait for a response from the firewall.
It is possible that it will send this back and Aristid packet which will tell us that the port behind
the firewall is open.
We can scan a computer protected by a firewall by fragmenting packets.
We can do fragmentation at a lower layer thanks to that after reassembling the peccant is not treated
by the firewall as hostile.