4.4 Summarize common networking attacks. Flashcards
Denial of service
Force a service to fail
Take advantage of a design failure or vulnerability
Cause a system to be unavailable
Create a smokescreen for some other exploit
Doesn’t have to be complicated - Turn off the power
A “friendly” DoS
Unintentional DoSing -
Network DoS - Layer 2 loop without STP
Bandwidth DoS - Downloading multi-gigabyte Linux distributions over a DSL line
Distributed Denial of Service (DDoS)
Launch an army of computers to bring down a service
This is why the bad guys have botnets
Asymmetric threat
DDOS amplification
Turn your small attack into a big attack
An increasingly common DDoS technique
Uses protocols with little (if any) authentication or checks - NTP, DNS, ICMP
DNS Amplification
Botnet C&C sends a single message to the botnet
Bots send spoofed DNS requests
DNS revolvers send amplified DNS responses to the Web Server
Effective social engineering
Constantly changing - You never know what’s next
May involve multiple people
May be in person or electronic - email, phone
Social engineering principles
- Authority
- Intimidation
- Consensus / Social proof
- Scarcity
- Urgency
- Familiarity / Liking
- Trust
Authority
The social engineer is in charge• I’m calling from the help desk/office of the CEO/police
Intimidation
There will be bad things if you don’t help
If you don’t help me, the payroll checks won’t be processed
Consensus / Social proof
Convince based on what’s normally expected• Your co-worker Jill did this for me last week
Scarcity
The situation will not be this way for long
Must make the change before time expires
Urgency
Works alongside scarcity - Act quickly, don’t think
Familiarity / Liking
Someone you know, we have common friends
Trust
Someone who is safe
I’m from IT, and I’m here to help
Insider threats
- Significant security issues• Harms reputation
- Critical system disruption
- Loss of confidential or proprietary information
- Innocent employees - Phishing scams, hacking scams
- Disgruntled employees - Someone is out to get you
- Careless employees - Using a laptop for personal use
- Defense in depth - Cover all possible scenarios
Logic Bomb
• Waits for a predefined event
• Often left by someone with grudge
Time bomb• Time or date• User event• Logic bomb• Difficult to identify• Difficult to recover if it goes off
Preventing a logic bomb
Difficult to recognize - Each is unique
• No predefined signatures
• Process and procedures - Formal change contro
l• Electronic monitoring - Alert on changes - Host-based intrusion detection, Tripwire, etc.
• Constant auditing - An administrator can circumvent existing system
Rogue access points
A significant potential backdoor
Very easy to plug in a wireless AP
Schedule a periodic survey
Consider using 802.1X (Network Access Control)
Wireless evil twins
Buy a wireless access point Configure it exactly the same way as an existing network Overpower the existing access points WiFi hotspots are easy to fool You encrypt your communication, right?
Wardriving
Combine WiFi monitoring and a GPS
Huge amount of intel in a short period of time
All of this is free - Kismet, inSSIDer - Wireless Geographic Logging Engine - http://wigle.net
Always an alternative - Warflying, warbiking
Phishing
Often delivered by spam, IM, etc. - Very remarkable when well done
- Check the URL
- Usually there’s something not quite right • Spelling, fonts, graphics • Vishing is done over the phone • Fake security checks or bank updates
Spear phishing
Phishing with inside information
Makes the attack more believable
Whaling
Spear phishing the CEO is “whaling”
Ransomware
Locks your computer “by the police”
The ransom may be avoided
• A security professional may be able to remove these kinds of malware
Crypto-malware
New generation of ransomware
Malware encrypts your data files
You must pay the bad guys to obtain the decryption key
Protecting against ransomware
Always have a backup
Keep your operating & applications system up to date - patches
Keep your anti-virus/anti-malware signatures up to date
DNS Poisoning
-Modify the DNS server
1. User 1 performs a normal DNS query to the DNS server:
-Modify the client host file
2. Bad guy modifies the DNS records and changes the IP address
Send a fake response to a valid DNS request• Requires a redirection of the original request or the resulting response
3. User 2 performs the same DNS query as User 1, but now the poisoned DNS entry is returned:
Spoofing
Pretend to be something you aren’t
Email address spoofing
• The sending address of an email isn’t really the sender• Caller ID spoofing
• The incoming call information is completely fake• Man-in-the-middle attacks
• The person in the middle of the conversation pretends to be both endpoints
MAC spoofing
Your Ethernet device has a MAC address Most drivers allow you to change this Changing the MAC address can be legitimate It might not be legitimate Very difficult to detect
IP address spoofing
Take someone else’s IP address
Can be legitimate
May not be legitimate
Easier to identify than MAC address spoofing
Spoofing cont
A legitimate response to an ARP request is received from the default gateway.The ARP response is cached on the local device
An attacker sends an ARP response that spoofs the IP address of the router and includes the attacker’s MAC address.The malicious ARP information replaces the cached record, completing the ARP poisoning
Wireless Deauthentication
Wireless deauthentication• A significant wireless denial of service (DoS) attack
