Question

This week we discussed hiding data using packet headers and some common headers that are found in most packets sent across a network, such as sequence number and acknowledgement number. Do some research and provide an actual example of a header being modified and your thoughts on how it was implemented. This can be an actual malware case, breach, white paper, or other similar example. For your example, can you think of any ways that it might be prevented or detected?

Answer 1

Packet header modification is a process where header is changed such a way to penetrate into a network’s infrastructure. In this process, the attacker will collect important weak information regarding the network and then the attacker ensures that the attack is as “invisible” on the network so that the attack is undetected. For instance, spoofed source address with a fake TCP sequence number and the most interesting part is that the attacker does not to assemble the packer header from the start instead the attacker can catch the on going packet from the network and carry out the process. In-order to overcome the firewall, a packet header with a false source IP address with ACK field can be built to test the responses of a firewall. In the aspect of host header modification, the X-Forwarded-Host header is employed in which it will rewrite the value of the host header. For example, this PHP script is considered as host header modification:

<script src="http://<?php echo _SERVER['HOST'] ?>/script.js">

With this header, the attacker can modify code by creating HTML output :

<script src="http://attacker.com/script.js">

In-order prevent such kinds of attack, we can employ content-security-policy HTTP header provides security against Cross Site Scripting (XSS) and other code injection attacks. It first gathers content sources and filters based on the approval of content and loads it to the browser. The x-xss-protection header also provides protection, for example:

header always set x-xss-protection "1; mode=block" for apache server browser.

The strict-transport-security header is an important web browsers over HTTPS. It works by detecting insecure HTTP connection which could be prone to attacks.