1.4 Given a scenario, analyze potential indicators associated with network attacks.

Question 1

What is an Evil Twin Attack?

Answer 1

It is where a hacker sets up a rogue AP that broadcasts the same SSID (Service Set Identifier), which appears as the wireless network’s name to ordinary users. This Evil Twin does not use the same security level as the legitimate AP so users will connect easier to that Evil twin. Once connected, the attacker can intercept the user’s traffic and game access to credentials or personal information.

Question 2

What is a Rogue Access Point?

Answer 2

It is a WAP that is set up in a secure network that attracts people to connect to it. A malicious person can deliberately set up a rogue AP the collect network traffic.

Question 3

What is Bluesnarfing?

Answer 3

A bluetooth attack in which an attacker steals data from the target device by connecting to an unsuspecting user’s device.

Question 4

What is Bluejacking?

Answer 4

Bluejacking is where an attacker connects to an unsuspecting user’s device and involves sending data to a target device. such as a smartphone, usually in the form of unsolicited texts messages. It is mainly used to annoy and harass people, but DOES NOT steal data from the user.

Question 5

What is a Disassociation attack?

Answer 5

A malicious user sends a deauthentication frame to the WAP with a spoof MAC address of a victim that is currently on the WAP. This WAP will then kick the victim off and the victim’s machine will try to reconnect or associate automatically. This malicious actor can then perform a bunch of attacks on the victim whether it is an evil twin, brute-force attack, DoS, Man-in-the-middle attack, etc.

Question 6

What is wireless jamming?

Answer 6

Jamming is a form of intentional interference on wireless networks, designed as a DoS attack typically. This type of attack overpowers the signals of a legitimate wireless access point, typically using a rogue AP with its transmit power set to very high levels.

Question 7

What is Radio Frequency Identification (RFID)?

Answer 7

It is a type of technology that uses a low power radio signal from the chip implanted in a card and a device that scans it in order to ID the person or give credentials. It needs to be close in order to read the RFID. Unfortunately, this is vulnerable to many types of attacks.

Question 8

What is Near Field Communication?

Answer 8

This enables devices to send a very low-power radio signal to each other by a special chip implanted in a device/card/etc. It needs to be very close in order to read the device. Usually 4 inches or closer.

Question 9

What is an Initialization Vector?

Answer 9

It is an arbitrary number that can be used along with a secret key for data encryption. This number, called a nonce, is employed only one time in any session. It helps prevent repetition in encryption, making it more difficult for a dictionary attack.

Question 10

What is an on-path attack(Also referred to Man-in-the-middle Attack)?

Answer 10

It is an sophisticated attack where you insert something on the path between a legitimate system and a trusted resource.

Question 11

What is Address Resolution Protocol (ARP) Poisoning?

Answer 11

When some system gives false ARP information to another system, this poisons the victim’s ARP Cache. ARP poisoning can allow an attacker to send ARP commands to the victim’s system to redirect traffic to the attacker’s system. ARP poisoning software can help to create MITM attacks and MAC flooding.

Question 12

What is Media Access Control (MAC) flooding?

Answer 12

Attackers can send many new frames with “new” source MAC addresses, seeking to overwhelm the limited capacity of the CAM table(this holds MAC addresses in a switch). It will cause a Switch to broadcast all traffic and send ARPS to try to rebuild a CAM table and an attacker can implant their MAC addresses via ARP poisoning.

Question 13

What is MAC Cloning?

Answer 13

It is when an attacker changes the MAC address of a device to match the MAC address of another device in order to gain illicit access to the network. In order for MAC Cloning to work, the attacker needs to disable the victim’s device MAC since there can’t be two of the same MAC addresses.

Question 14

What is Domain Name System (DNS)?

Answer 14

DNS resolves internet names to IP addresses. DNS consists of clients(need name resolution services) and servers(provides name translation services).

Question 15

What is Domain Hijacking?

Answer 15

Domain Hijacking means to take control of legitimate domain registration in some way that the actual owner does not desire.

Question 16

What is DNS Poisoning?

Answer 16

DNS cache poisoning is an attack that targets a DNS Server to query an evil DNS server instead of the correct one, the evil server can in turn tell the target DNS server spoofed DNS information. This victim DNS server will cache that spoofed information and spread it to hosts and possibly other DNS servers.

Question 17

What is URL Redirection?

Answer 17

It is an attack that dupes a viewer, usually of an email message, into clicking a URL that looks like a legit site but redirects them to a scam site. URL Redirections are part of every phishing email.

Question 18

What is Domain Reputation

Answer 18

It is where owners of those shady domains that find themselves on the naughty blacklist a chance to restore their reputation.

Question 19

What is a DDoS attack?

Network
Application
Operational Technology

Answer 19

A DDoS attack is when many systems send requests to a server with the goal of swamping the server with clients so that it responds too slowly for legitimate users or, in some cases, causes the server to reboot/fail/lockup or drop an entire network if successful.

DDoS can drop an entire network if successful.
DDoS can stop a specific application from working.
DDoS can cause operational technology such as powerplants with older technology to fail (this is particularly bad).

Question 20

What is malicious code or script execution?

Powershell
Python
Bash
Macros
Visual Basic for Applications(VBAs)

Answer 20

Actions such as changing file permissions with these powerful languages can be done maliciously. We can limit what bad actors can do with these languages by watching for indicators of compromise or disabling a lot of code functionality. Things like execution policies and constrained language mode.