Novell LINUX ENTERPRISE DESKTOP 10 SP2 - DEPLOYMENT GUIDE 08-05-2008 Deployment Manual page 797

exploit these newly-found security holes—are often posted on the security mailing lists.
They can be used to target the vulnerability without knowing the details of the code.
Over the years, experience has shown that the availability of exploit codes has contribut-
ed to more secure operating systems, obviously due to the fact that operating system
makers were forced to fix the problems in their software. With free software, anyone
has access to the source code (SUSE Linux Enterprise comes with all available source
codes) and anyone who finds a vulnerability and its exploit code can submit a patch to
fix the corresponding bug.
44.1.10 Denial of Service
The purpose of a denial of service (DoS) attack is to block a server program or even
an entire system, something that could be achieved by various means: overloading the
server, keeping it busy with garbage packets, or exploiting a remote buffer overflow.
Often a DoS attack is made with the sole purpose of making the service disappear.
However, once a given service has become unavailable, communications could become
vulnerable to man-in-the-middle attacks (sniffing, TCP connection hijacking, spoofing)
and DNS poisoning.
44.1.11 Man in the Middle: Sniffing,
Hijacking, Spoofing
In general, any remote attack performed by an attacker who puts himself between the
communicating hosts is called a man-in-the-middle attack. What almost all types of
man-in-the-middle attacks have in common is that the victim is usually not aware that
there is something happening. There are many possible variants, for example, the attacker
could pick up a connection request and forward that to the target machine. Now the
victim has unwittingly established a connection with the wrong host, because the other
end is posing as the legitimate destination machine.
The simplest form of a man-in-the-middle attack is called sniffer—the attacker is "just"
listening to the network traffic passing by. As a more complex attack, the "man in the
middle" could try to take over an already established connection (hijacking). To do so,
the attacker would need to analyze the packets for some time to be able to predict the
TCP sequence numbers belonging to the connection. When the attacker finally seizes
the role of the target host, the victims notice this, because they get an error message
saying the connection was terminated due to a failure. The fact that there are protocols
Security and Confidentiality 781