The Internet employs several communication protocols to achieve its
functionality. The two most important Internet protocols are transmission control protocol (TCP) and the Internet protocol (IP) – As known as TCP/IP.
INTERNET PROTOCOL (IP)
The Internet Protocol (IP) is the network layer of the Internet. Its job is to route and send a packet of data to its destination. The data packets travel through a sequence of routers before they reach their goal. At each intermediate point in this transmission, nodes determine the next hop for the data packet. This provides the strength of dynamic routing-in the event that a portion of the network goes down for any reason (such as power failures), a data packet would be rerouted through a different path. It is very possible that two data packets from the same source might take entirely different paths to get to their destination, much like two cars leaving a neighborhood might take entirely different streets to get to the same grocery store due to traffic jams.
This dynamic quality introduces a degree of unpredictability in arrival
times of data packets. In the same way that there is no guarantee that two data packets will arrive at their destination following the same path, there is also no guarantee that they will arrive in sequence. IP is a “best efforts” system that does not assure that packets will arrive or in what sequence.
The task of reassembling all the data packets is left to higher layers in the protocol stack. Moreover, the data packet and its header (the “address” that contains the destination and route information for the data packet) are not encrypted-it is a simple matter to replace the intended address of a data packet with an alternate that delivers the data packets to an attacker. The IP protocol will oblige.
TRANSMISSION CONTROL PROTOCOL (TCP)
The “higher layer” that has the responsibility of data-packet management referred to above is the TCP layer. In today’s Internet, the TCP layer provides the guaranteed delivery and also is responsible for correctly reassembling the file from all of its composite data packets.
It communicates with the sender and receiver through various handshakes and timing mechanisms that trigger repeated requests. The handshakes that the TCP protocol employs are called SYN and ACK-when computer. A seeks a connection with computer B, computer A sends a SYN flag to B. Upon receiving the SYN flag, computer B responds with an ACK flag. This is the basic connection handshake that initiates a connection.
SYN FLOOD
One of the basic attacks that can be performed on the Internet is the
SYN flood. In this attack, a malicious programmer arranges for his computer to send a very rapid series of SYN requests to a target computer. If the target computer obliges and returns an ACK for each SYN flag and does not “recognize” the flood as being malicious (“normal” computers don’t behave this way), it will quickly consume all available ports and processing power trying to satisfy the SYN flood. This is one way to create what is referred to as a “denial of service” in which the target computer effectively cannot respond to any other requests.
Simultaneous SYN packets from two different (attacking) computers
can cause confusion at the target machine and cause a connection port to freeze, creating an opportunity for malicious attackers to capitalize on other weaknesses in the TCP / IP protocol in order to gain access to information on the target machine.
As mentioned above, the IP layer does no form of authentication to
determine if the IP address of a data packet actually originated at that IP address.
IP SPOOFING
Another form of attack, called IP spoofing, replaces an attacking
computer’s actual IP address in the TCP/IP data packet headers with the IP address of another computer, spoofing its IP address.
Since there is noauthentication of the IP address, the target computer sends its responses to the spoofed IP address, rather than the IP address of the attacker. There is no record of any unusual SYN request activity from the attacker’s IP address, but rather the SYN activity is seen as coming from the spoofed IP address. The attacker remains anonymous.
Any attempt by the IT department that owns the targeted computer to contact the ISP of the “attacker” in order to shut down the account results in an unsubstantiated claim in one case (there was no SYN flood originating on the computer whose IP address was spoofed) or the suspension of an innocent third party in another case.
Such an IP spoofing attack can be used to establish a one-way communication with a target computer, and techniques can be applied to convert this to a two-way communication in which the attacker can take control of the target computer or otherwise gain access to protected information.
Source: Computer Security Techniques To Defeat HACKERS by WILEY