chapter 4 Flashcards
HIDS
A host-based intrusion detection system. additional software installed on a system such as a workstation or a server.
A HIDS can monitor all traffic on a single host system such as a server or a workstation. In some cases, it can detect malicious activity missed by antivirus software.
NIDS
network-based intrusion detection system A NIDS console is installed on a network appliance. Sensors are installed on network devices such as switches, routers, or firewalls to monitor network traffic and detect network-based attacks. You can also use taps or port mirrors to capture traffic. A NIDS cannot monitor encrypted traffic and cannot monitor traffic on individual hosts.
Signature-based IDSs
Signature-based IDSs (sometimes called definition-based) use a database of known vulnerabilities or known attack patterns.
Trend-Based Detection
Trend-based detection (sometimes called anomaly detection) starts by identifying the network’s regular operation or normal behavior. It does this by creating a performance baseline under normal operating conditions.
Trend-based detection can be effective at discovering zero-day exploits unknown to the vendor, so the vendor has not released a patch. If the vulnerability isn’t known and there’s no patch for it, there won’t be a signature for it either.
SYN Flood Attack
The SYN flood attack is a common denial-of-service (DoS) attack. Chapter 3 describes the three-way handshake to establish a session. As a reminder, one system sends a SYN packet, the second system responds with a SYN/ACK packet, and the first system then completes the handshake with an ACK packet. However, in a SYN flood attack, the attacker sends multiple SYN packets but never completes the third part of the TCP handshake with the last ACK packet.
IPS Versus IDS—In-line Versus Passive
Because an IPS is in-line with the traffic, it is sometimes referred to as active. In contrast, an IDS is referred to as passive because it is not in-line with the traffic. Instead, it is out-of-band with the network traffic.
APT
advanced persistent threats (APTs)
honeypot
Deceive the attackers and divert them from the live network. If an attacker spends time in the honeypot, they are not attacking live resources. Allow observation of an attacker. While an attacker is in the honeypot, security professionals can observe the attack and learn from the attacker’s methodologies. Honeypots can also help security professionals learn about zero-day exploits or previously unknown attacks.
site survey
A site survey examines the wireless environment to identify potential problem areas. A heat map shows wireless coverage and dead spots if they exist. Wireless footprinting gives you a detailed diagram of wireless access points, hotspots, and dead spots within an organization.
A site survey examines the wireless environment to identify potential problem areas. A heat map shows wireless coverage and dead spots if they exist. Wireless footprinting gives you a detailed diagram of wireless access points, hotspots, and dead spots within an organization.
honeytoken
A honeytoken is a fake record inserted into a database to detect data theft.
AP
Access Point wireless access point A wireless access point (AP) connects wireless clients to a wired network. However, many APs also have routing capabilities.
All wireless routers are APs.
Not all APs are wireless routers.
NAT
Network Address Translation
PAT
Port Address Translation
MAC Address Cloning
MAC address cloning refers to changing the MAC address on a PC or other device with the same MAC address as the wide area network (WAN) port on an Internet-facing router. MAC address cloning sometimes resolves connectivity issues on small home or office networks. In a MAC cloning attack (sometimes called a MAC spoofing attack), an attacker changes his computer’s MAC address to the MAC address of an authorized system. This will bypass MAC filtering.
Wi-Fi analyzer
Used in Site Survey
heat map
Other site survey tools will create a heat map, which gives you a color-coded representation of wireless signals. For example, the color green may show where the wireless signals are the strongest, and the color red may show where they are the weakest. By walking around an organization and recording wireless activity, the heat map will show where the wireless signals are the strongest and where you may have dead spots.
footprinting
Wireless footprinting creates a detailed diagram of APs and hotspots within an organization. By overlaying the heat map onto a basic architectural drawing of an organization’s spaces, it’s possible to see the location of the APs along with dead spots and hotspots.
WPA2
Wi-Fi Protected Access 2 WPA2 (also known as IEEE 802.11i) uses strong cryptographic protocols such as Advanced Encryption Standard (AES) and Counter-mode/CBC-MAC Protocol (CCMP).
WPA2 can operate in open, pre-shared key (PSK). No user name no identity.
Enterprise. Enterprise mode forces users to authenticate with unique credentials before granting access to the wireless network.
When you select Enterprise mode, you’ll need to enter three pieces of information: RADIUS server. You enter the IP address assigned to the 802.1X server, which is often a RADIUS server.
RADIUS port. You enter the port used by the RADIUS server. The official default port for RADIUS is 1812. However, some vendors have used other ports, such as 1645. The key is that you must enter the same port here that the server is using.
Shared secret. The shared secret is similar to a password, and you must enter it here exactly as it is entered on the RADIUS server. This is different than the user’s password.
disassociation attack
After a wireless client authenticates with a wireless AP, the two devices exchange frames, causing the client to be associated with the AP. At any point, a wireless device can send a disassociation frame to the AP to terminate the connection. This frame includes the wireless client’s MAC address.
When the AP receives the disassociation frame, it deallocates all its memory for the connection. In a disassociation attack, attackers send a disassociation frame to the AP with a spoofed MAC address of the victim. The AP receives the frame and shuts down the connection. The victim is now disconnected from the AP and must go through the authentication process again to reconnect.
WPS
Wi-Fi Protected Setup Wi-Fi Protected Setup. Reaver is an open-source tool that allows attackers to discover the PIN within about 10 hours and often much quicker. Once it discovers the PIN, it can discover the passphrase in WPA2 wireless networks. However, WPS is safe if it is used with WPA3.
rogue AP
Rogue Access Point A rogue access point (rogue AP) is an AP placed within a network without official authorization. It might be an employee bypassing security or installed by an attacker. If an employee installs a rogue AP, the chances are higher that this AP will not be adequately managed, increasing vulnerabilities to the network.
evil twin
An evil twin is a rogue access point with the same SSID (or similar) as a legitimate access point. You can think of the SSID of the evil twin as a twin of the legitimate AP’s SSID. For example, many public places, such as coffee shops, hotels, and airports, provide free Wi-Fi. An attacker can set up an AP using the same SSID as the public Wi-Fi network, and many unsuspecting users will connect to this evil twin.
Jamming Attacks
Attackers can transmit noise or another radio signal on the same frequency used by a wireless network. This interferes with the wireless transmissions and can seriously degrade performance. This denial-of-service attack is commonly called jamming, and it usually prevents all users from connecting to a wireless network. In some cases, users have intermittent connectivity because the interference causes them to lose their association with the AP and forces them to reconnect. I
n some cases, you can increase the power levels of the AP to overcome the attack. Another method of overcoming the attack is to use different wireless channels. Each wireless standard has several channels you can use, and if one channel is too noisy, you can use another one. Although this is useful for overcoming interference in home networks, it won’t effectively combat an interference attack. If you switch channels, the attacker can also switch channels.
IV Attacks
An initialization vector (IV) is a number used by encryption systems, and a wireless IV attack attempts to discover the pre-shared key after first discovering the IV. Some wireless protocols use an IV by combining it with the pre-shared key to encrypt data in transit. When an encryption system reuses the same IV, an IV attack can discover the IV easily. As an example, WEP, an early wireless security protocol, uses a relatively small 24-bit number for the IV. This small IV resulted in wireless networks reusing keys, making WEP easy to crack.
