4.2 Compare and contrast common types of attacks. Flashcards
Denial-of-service (DoS)
Denial-of-Service (DoS) refers to an attack aimed at making a network resource unavailable to its intended users by overwhelming it with a flood of illegitimate requests. The objective is to disrupt the normal functioning of a targeted server, service, or network by exhausting its resources, such as bandwidth, memory, or processing power. DoS attacks can take various forms, including simple flood attacks or more sophisticated methods that exploit vulnerabilities in network protocols.
For your exam, it’s important to recognize the key characteristics of DoS attacks, including their various types, such as flooding attacks, application-layer attacks, and resource exhaustion. Understanding the difference between a DoS attack and a Distributed Denial-of-Service (DDoS) attack, which involves multiple compromised systems working together to launch an attack, is crucial. Be prepared to discuss common mitigation strategies, such as rate limiting, traffic filtering, and using anti-DDoS services, as well as the potential impacts of a successful attack on an organization’s operations and reputation. Understanding the legal and ethical implications of DoS attacks is also relevant, as they are often considered illegal and can lead to severe penalties for perpetrators.
distributed denial-of-service (DDoS)
Distributed Denial-of-Service (DDoS) is a type of cyberattack in which multiple compromised systems, often referred to as a botnet, are used to flood a target server, service, or network with an overwhelming amount of traffic. The primary goal of a DDoS attack is to disrupt the normal functioning of the targeted system, rendering it unavailable to legitimate users. DDoS attacks can take various forms, including volumetric attacks that consume bandwidth, protocol attacks that exploit weaknesses in network protocols, and application-layer attacks that target specific applications.
For the exam, it’s essential to understand the mechanics of DDoS attacks, including how they are launched and the technologies used to execute them, such as malware that infects devices and turns them into bots. Be familiar with the differences between DDoS and regular Denial-of-Service (DoS) attacks, noting that DDoS attacks involve multiple sources while DoS attacks originate from a single source. You should also know common mitigation strategies, such as using traffic analysis, rate limiting, and deploying specialized DDoS protection services. Understanding the potential impact of a successful DDoS attack on business operations, customer trust, and reputation is critical, as these attacks can lead to significant financial losses and disruptions.
Botnet/command and control
A botnet is a network of compromised computers or devices, often referred to as “bots” or “zombies,” that are controlled remotely by a cybercriminal. These devices can be infected with malware, allowing the attacker to manage them without the owner’s knowledge. The primary purpose of a botnet is to perform automated tasks on a large scale, often for malicious activities such as launching Distributed Denial-of-Service (DDoS) attacks, sending spam emails, stealing data, or executing other harmful operations.
For the exam, it’s crucial to understand the concept of command and control (C2 or C&C) within the context of botnets. The command and control server is the central point through which an attacker sends commands to the infected devices. This server facilitates communication between the attacker and the botnet, allowing the attacker to coordinate actions, deploy additional malware, or extract data. Familiarize yourself with common methods attackers use to establish command and control, such as using Internet Relay Chat (IRC), HTTP/HTTPS, or peer-to-peer networks to disguise the communication. Recognizing the signs of botnet activity, such as unusual network traffic or system performance issues, is important for effective threat detection and mitigation. Understanding the impact of botnets on network security and how to defend against them through techniques like intrusion detection systems, firewalls, and regular software updates is also essential.
On-path attack (previously known
as man-in-the-middle attack)
An on-path attack, previously known as a man-in-the-middle (MITM) attack, occurs when an attacker intercepts and alters communication between two parties without their knowledge. In this scenario, the attacker positions themselves between the sender and receiver, enabling them to eavesdrop, manipulate data, or inject malicious content into the communication stream. This type of attack can target various protocols, including HTTPS, HTTP, and others, making it a significant threat in network security.
For the exam, it’s important to recognize the methods used in on-path attacks. Attackers can utilize techniques such as ARP spoofing, where they send falsified Address Resolution Protocol (ARP) messages to link their MAC address with the IP address of a legitimate device. This allows the attacker to intercept traffic intended for that device. Another common method is using rogue access points to trick users
- DNS poisoning
DNS poisoning, also known as DNS spoofing, is a type of attack where an attacker manipulates the Domain Name System (DNS) cache to redirect users from legitimate websites to malicious ones. This occurs when the attacker alters the IP address associated with a domain name in a DNS resolver’s cache. As a result, users attempting to visit a legitimate website may be unknowingly sent to a fraudulent site, potentially leading to data theft or malware infection.
For the exam, you should understand the impact of DNS poisoning on network security. It can be used to facilitate phishing attacks, spread malware, or perform other malicious activities by tricking users into believing they are accessing a trusted site. Additionally, knowing how to prevent DNS poisoning is crucial. Techniques include using DNSSEC (Domain Name System Security Extensions) to authenticate DNS responses and implementing proper security measures on DNS servers to mitigate the risk of cache poisoning.
- VLAN hopping
VLAN hopping is a type of network attack where an attacker gains unauthorized access to multiple Virtual Local Area Networks (VLANs) by exploiting the way VLAN tagging is handled in switches. This attack typically involves two methods: switch spoofing and double tagging. In switch spoofing, the attacker tricks a switch into treating their device as a trunk port, allowing them to send traffic to all VLANs. In double tagging, the attacker sends a frame with two VLAN tags, where the outer tag is stripped off by the first switch, allowing the inner tag to reach another VLAN that the attacker should not access.
For the exam, you should know the potential risks associated with VLAN hopping, such as data breaches and unauthorized access to sensitive information. Understanding how to mitigate VLAN hopping is also important. This can be achieved by configuring switch ports properly, disabling unused ports, and limiting trunk ports to only trusted devices. Implementing proper VLAN segmentation and ensuring that only authorized users have access to specific VLANs will help secure the network against this type of attack.
- ARP spoofing
ARP spoofing is a technique used by attackers to associate their MAC address with the IP address of another host on the network, effectively allowing them to intercept, modify, or block communications between devices. This is accomplished by sending false Address Resolution Protocol (ARP) messages over the local network, which updates the target’s ARP table with the attacker’s MAC address. As a result, any traffic intended for the legitimate device is instead sent to the attacker.
For the exam, you should understand the implications of ARP spoofing, including its potential to facilitate man-in-the-middle attacks, data theft, or denial of service. It’s also important to recognize mitigation strategies, such as using static ARP entries for critical devices, implementing dynamic ARP inspection (DAI) on switches, and employing VLAN segmentation to reduce the attack surface. Monitoring network traffic for unusual ARP activity can also help in detecting and preventing ARP spoofing attempts.
- Rogue DHCP
Rogue DHCP refers to an unauthorized DHCP server that is set up on a network, often by an attacker, to distribute incorrect IP address configurations to clients. This can lead to various malicious outcomes, such as intercepting network traffic, conducting man-in-the-middle attacks, or denying legitimate users access to network resources. Rogue DHCP servers can assign IP addresses from the same subnet as the legitimate server but can also provide incorrect gateway and DNS server addresses, leading clients to route their traffic through the attacker’s device.
For the exam, it’s important to know how rogue DHCP servers can compromise network security. Understanding mitigation techniques is also essential. These include implementing DHCP snooping on switches to allow only trusted DHCP servers, regularly monitoring the network for unauthorized devices, and segmenting the network to limit the impact of potential rogue devices. Awareness of these strategies helps maintain the integrity of the DHCP service and protects against unauthorized network access.
Rogue access point (AP)
A rogue access point (AP) is an unauthorized wireless access point that is connected to a network without the knowledge or approval of network administrators. These devices can be set up by malicious actors or even well-intentioned employees, often to bypass security measures or to provide network access in areas where it is not officially authorized. Rogue APs can lead to various security risks, including unauthorized access to sensitive data, man-in-the-middle attacks, and network breaches.
For the exam, it is crucial to recognize the potential dangers posed by rogue access points, such as data interception and network compromise. You should also be familiar with preventive measures to mitigate these risks. This includes implementing a robust wireless security policy, using network monitoring tools to detect unauthorized devices, and enforcing strict authentication methods for users connecting to the network. Awareness of these strategies can help secure the wireless environment and maintain overall network integrity.
Evil twin
An evil twin is a type of Wi-Fi attack where a malicious actor sets up a rogue wireless access point that mimics a legitimate network. This access point typically uses the same SSID (network name) as the legitimate one, tricking users into connecting to it instead. Once connected, the attacker can intercept sensitive information, such as login credentials and personal data, or launch further attacks against the user’s device.
For the exam, it is important to understand how evil twin attacks exploit the trust users place in familiar network names. You should be aware of the signs of an evil twin, such as unexpected changes in network performance or security warnings about the network. To mitigate the risk of falling victim to an evil twin attack, users should verify the legitimacy of the network before connecting and use a VPN for an additional layer of security. Familiarity with these protective measures will help enhance awareness and security in wireless environments.
Ransomware
Ransomware is a type of malicious software designed to block access to a computer system or data, typically by encrypting files, until a ransom is paid to the attacker. Once the ransomware infects a device, it may display a message demanding payment in cryptocurrency in exchange for a decryption key. This payment does not guarantee that access will be restored, as some attackers may not provide the key or may demand further payments.
For the exam, it’s important to understand the mechanisms through which ransomware spreads, such as phishing emails, malicious downloads, or exploiting vulnerabilities in software. You should also be aware of the steps to take if infected, which include isolating the infected system, reporting the incident, and restoring data from backups. Preventative measures include keeping software up to date, using reputable security solutions, and educating users about safe browsing and email practices. Recognizing these aspects will help in understanding how to defend against ransomware threats effectively.
Password attacks - Brute-force
A brute-force attack is a method used to gain unauthorized access to a system by systematically trying every possible combination of passwords until the correct one is found. This type of attack relies on the computational power of the attacking machine, which can be either a single device or a botnet of multiple machines working together. Because brute-force attacks can potentially try every combination, they can be effective against weak passwords that lack complexity and length.
For the exam, it’s important to know that brute-force attacks can be mitigated through various strategies. These include implementing account lockout policies after a certain number of failed login attempts, using CAPTCHAs to differentiate between human users and automated attacks, and encouraging the use of strong, complex passwords that incorporate a mix of letters, numbers, and symbols. Additionally, organizations can deploy rate limiting on login attempts to slow down brute-force attempts and consider using multi-factor authentication (MFA) as an additional layer of security. Understanding these countermeasures will help in recognizing how to protect systems from brute-force attacks effectively.
Password attacks - Dictionary
A dictionary attack is a method used to compromise passwords by systematically entering every word in a predefined list, often composed of commonly used passwords and words from the dictionary. This type of attack capitalizes on the tendency of users to choose simple, easily guessable passwords, such as “password,” “123456,” or “letmein.” Dictionary attacks are more efficient than brute-force attacks because they focus on probable passwords rather than every possible combination.
For the exam, it’s important to know that dictionary attacks can be countered by implementing strong password policies. This includes requiring passwords to have a minimum length, incorporating a mix of uppercase and lowercase letters, numbers, and special characters. Encouraging users to create complex passwords and using password managers to generate and store strong passwords can significantly reduce the risk of dictionary attacks. Additionally, organizations can deploy account lockout mechanisms after a certain number of failed login attempts to deter these types of attacks. Understanding these preventive measures will help in recognizing how to enhance password security effectively.
- MAC spoofing
MAC spoofing is a technique used to change the Media Access Control (MAC) address of a network interface on a device. This is often done to disguise the identity of the device on the network or to bypass access control mechanisms that rely on MAC addresses for authentication. By altering the MAC address, a device can impersonate another device or evade security measures designed to restrict network access based on predefined MAC addresses.
For the exam, it’s essential to understand that MAC spoofing can pose security risks, such as unauthorized access to a network or the ability to intercept data meant for another device. To mitigate these risks, organizations can implement security measures like port security on switches, which limits the number of MAC addresses allowed on a port, and network access control lists (ACLs) to monitor and restrict traffic based on MAC addresses. Additionally, using encryption protocols like WPA2 for wireless networks can help protect against MAC spoofing by securing the data transmission, regardless of the device’s MAC address. Recognizing the implications of MAC spoofing and the strategies to prevent it is crucial for maintaining network security.
- IP spoofing
IP spoofing is a technique where an attacker sends IP packets from a false (or “spoofed”) source address to disguise their identity or to impersonate another device. This is commonly used in various types of attacks, including denial-of-service (DoS) attacks, where the attacker floods a target with requests from numerous IP addresses to overwhelm it. By masking their true IP address, the attacker can evade detection and complicate the process of tracing the attack back to its source.
For the exam, it’s important to know that IP spoofing can facilitate several security threats, such as session hijacking, where an attacker takes control of a user session by exploiting the trust established between devices. To mitigate these risks, network administrators can employ strategies such as ingress and egress filtering, which inspect packets at the network boundary to ensure that incoming and outgoing traffic has valid source addresses. Implementing strong authentication methods and encryption can also help protect against the effects of IP spoofing, as they reduce the likelihood of successfully impersonating a legitimate device. Understanding IP spoofing and its potential implications is crucial for maintaining the integrity and security of network communications.
