1.4 - Given a scenario, analyze potential indicators associated with network attacks Flashcards
Given a scenario, analyze potential indicators associated with network attacks.
Evil twin
-rogue AP with name (SSID) similar to legit net.
-looks legit but is malicious (overpowers existing APs)
-wireless version of phishing
-usrs tricked into connecting
-perp can intercept/manipulate usrs net. traffic
-can compromise data, engage in mal. activities, steal creds, eavesdrop, monitor vics online activity
Indicators
-similar SSID
-unexpected auth/login attempts
-unusual/inconsistent net performance
Prevention
-use WPA3 encryption
-secure wifi config
-regularly monitor wifi
-employee education
-implement EAP-TLS 4 auth
-WIPS (wireless intrusion prevention sys.)
-net segmentation
-regular sec. audits
Rogue access point
-unauthorized wireless AP
-intentionally/unintentionally (employees/perps)
-easy to plug in/enable with ur OS
-easy to detect wth software
Can provide;
->potential backdoor
->unauthorized net. access
->expose sensitive data + resources
->modify, insert, delete packets
Indicators
-unknown devices on net.
-unusual SSIDs
-unexpected net. activity
Prevention/Detection
-wireless intrusion detection systems
-regular network scans
-schedule periodic surveys/sec. audits
-walk around ur building
-use 3rd party tools/wireless sniffing apps
-consider using 802.1x (net access control)
->have to authenticate regardless of connection type
-net. monitoring tools
-access control policies
-disable unused ports
-wireless site surveys
-think b4 connecting to free hotspot in public
-use VPNs or HTTPS
Bluesnarfing
-vics device data available 4 unauthorized access when paired with perps device
-more dangerous attack that can expose/alter usrs info
To steal info;
-contacts
-texts
-emails
-files
Indicators
-unexpected data access
-unusual bluetooth connections
-battery drain
-device lag/slow performance
Prevention
-set bluetooth to nondiscoverable mode
-update device firmware + sec. settings
-be cautious in public spaces
-monitor bluetooth connections
-sec. awareness training
Bluejacking
-unsolicited msgs/data sent to device via bluetooth
-txt msgs, contact cards, etc
-functional distance ~10 meters
-relatively harmless
Prevention
-bluetooth off when not in use
-don’t accept pairing reqs. from unknown devices
-don’t open files from strangers
-set device to nondiscoverable mode
Disassociation
-deauthentication attack
-target sys. forced to disassociate from AP it’s using > sys. attempts to reconnect > perp has chance to set up more powerful evil twin/capture info as it reconnects
-best way 4 perps to do this is to send deauthentication frame
-WPA2 often unencrypted which makes it easier
Indicators
-network suddenly disconnects
-repeated auth. requests
Prevention
-802.11W = required 4 802.11ac compliance
-Use WPA3 b/c requires protected mgmt frames + will prevent this type of deauthentication attack from working
-strong encryption
-sus. activity monitoring
-intrusion detection sys.
Jamming
-intentional
-blocks all traffic in range/frequency it’s conducted against
-sends out powerful traffic to drown out traffic
-requires physical proximity
-reactive jamming = only when someone tries communicating
-diff. types (constant, random bits,legit frames)
-gen. prohibited by FCC
-basically wireless interference
Indicators
-sudden net. outages
-increased packet loss
-slower net. performance
Detection/Prevention
-proper equip. to hunt down (directional antenna, attenuator)
-moving away can make difference
-locate jamming source OR boost signal being jammed
Radio frequency identification (RFID)
-short range wireless tech. that uses tag + receiver to exchange info
-EX: toll booths, access badges, pet IDs
-RF powers tag, ID transmits back (bidirectional comm.)
-2 types: active = signal over large distance b/c contains power source. passive = unpowered. activated by signal sent from reader.
Attacks
-capture data
-view comm.
-replay attack
-DoS
-spoof reader -> write ur own data to tag (data manipulation)
-decrypt comm. -> many default keys on google
-PRIVACY = big concern
-tags can be cloned, modified, spoofed
-readers can be impersonated
Near-field communication (NFC)
-set of standards 4 contactless comm. btwn devices
-short range (~4 inch)
-threats in close proximity to NFC device
-intercepting NFC traffic, replay attacks, spoofing
Security concerns
-remote capture
-frequency jamming
-relay/replay attacks
-malicious code
-loss of NFC device control
Prevention
-NFC devices must ensure they don’t respond to queries except when desired
-encrypt sensitive data
-user awareness + malware prevention = key ctrls 4 malicious code
Initialization vector (IV)
IV = random/nonrepeating value combined wth encryption key to provide additional layer of sec.
-vulns. in use/mgmt of IVs can lead to sec. issues
-type of nonce
-used 4 randomizing encryption scheme
-used in encryption ciphers, WEP, some SSL implementations
-WEP = used 24bit IV > could be reverse engineered when enough traffic from net. captured > after traffic analyzed the IV used to generate an RC4 key stream could be derived > all traffic sent on net. could be decrypted
Attacks = exploit weaknesses in IVs used in encryption algs.
-use passive statistical analysis
-can occur when IV too short + predictable + not unique
-types: IV reuse, prediction, manipulation
-not really a concern anymore since WPA2 and WPA3 don’t use week IVs making IV attack historical…
On-path attack (previously
known as man-in-the-middle attack/ man-in-the-browser attack)
-redirects ur traffic > passes on to destination
-u never know ur traffic was redirected
-perp can eavesdrop, alter comms/data + pass it along
-can be used to conduct SSL stripping
-if attempted on internal net. then physical access to net. is required
-DNS can be compromised + used to redirect initial service request
Protection
-restrict access to wiring closets + switches (secure physical environ.)
-restrict DNS access to read only 4 everyone except admin.
-use encryption/secure protocols
MITB = man in the browser attack. -new type of on path attack
-relies on trojan that’s inserted into usrs browser > trojan able to access + modify info sent and received by browser
-malware/trojan does all proxy work
-trojan infects browser components (plugins)
-dangerous b/c occurs at app level on usrs sys./capable of avoiding web app ctrls
-advantage to perps: easy to proxy encrypted traffic, looks normal to vic.
Chapple 389-391
Gibson 238-240
Weiss 31, 57-59
Layer 2 attacks
-data link layer
-responsible 4 transferring data btwn sys. on local net.
-packet fwdng decisions based on MAC addresses
-OSI models allows each layer to work wthout having to be considered wth the other layers > if physical layer is hacked, layer 2 suffers | if layer 2 is hacked, net. layer also compromised
Address Resolution Protocol (ARP) poisoning (Layer 2 attacks)
-limited to attacks that r based locally
-perp needs physical access OR ctrl of device on local net.
-perp tricks device into thinking any IP is related to any MAC address
-can lead to: DoS and On path attacks, MAC flooding
Detection
-tools like Wireshark
-purpose built net. sec. devices that perform protocol analysis + net. monitoring
Mitigation
-monitoring tools/IDS (intrusion detection sys.) > alert u when sus. activity occurs
-small net.
-> use static/script based mappings 4 IPs + ARP tables
-large net.
-> use equipment that has port sec.
-> permit only 1 MAC address 4 each physical port on switch
MAC cloning (Layer 2 attacks)
-perp changes MAC address to match an existing device
-circumvents filters
-create DoS = disrupt comm. to legit MAC
-manipulated easily thru software
-done by tools such as: macchanger and iproute2
-difficult to detect
-NAC (net. access ctrl)/other machine authentication + validation tech. can help identify
MAC randomization
-increased use of it to help preserve usr privacy
-adds complexity for net. admin. who use them to ascertain who was using a sys. when event/incident happened
-net. admin. may need more info to match usrs/sys./hardware addresses
-supposed to avoid collisions (when 2 devices select + use same MAC address), but it is possible -> collision would be indistinguishable from MAC cloning attack at first glance
Domain hijacking
-unauthorized transfer/ctrl of domain name
-get access to domain registration -> u ctrl where traffic flows
-can occur when domain ownership expires
-direct attacks result of sec. issues wth domain registrar OR via social engineering OR admin portal of domain owner
-get into acct by brute force, social engineer pswd, gain access to email address that manages the acct
-perp can post mal. content from domain on the web, redirect domain to another domain, sell domain
-can intercept traffic, send/receive email, take action appearing to be legit. domain holder
Detection
-sec.tools/features provided by domain registrars to protect + monitor domains
MAC flooding (Layer 2 attacks)
-targets switches by sending so many MAC addresses to switch that CAM/MAC tables is filled
-tables have limited space > flooding results in default behavior that sends traffic out to ALL ports when destination is unknown to ensure traffic keeps flowing > perps then capture traffic
-turns switch into hub
Prevention
-port security
-tools like NAC/other net. authentication + authorization tools
-VLANS (net. segmentation)
-MAC address filtering
-net. monitoring
