Chapter 7 - Protecting Against Advanced Attacks

Question 1

SYN Flood Attacks

Answer 1

A common DDoS attack use against servers on the internet, easy to launch and cause significant problems. The SYN flood disrupts the Transmission Control Protocol (TCP) 3-way process when establishing a session and can prevent legitimate clients from connecting.

Question 2

Spoofing

Answer 2

Occurs when a person or entity impersonates or masquerades as someone or something else.

Some common spoofing methods are related to an email address, an Internet Protocol (IP) address, and a media access control (MAC) address (which is assigned to the NIC and hard-coded into the NIC).

Question 3

On-path attack

Answer 3

Also called a Man-in-the-Middle attack is a form of interception or active eavesdropping. It uses a separate computer that accepts traffic from each party in a conversation and forwards traffic between the two.

The two computers are unaware of the attacking computer, but the attacker can interrupt the traffic at will, insert malicious code or simply eavesdrop.

When secure channels are used, the on-path system may use certificates that aren’t issued by a CA and will generate certificate warnings. SSH gives a warning if previously established keys have changed.

Question 4

SSL Stripping

Answer 4

Secure Sockets Layer (SSL) Stripping attack changes a HTTPS connection to a HTTP connection. HTTPS uses TLS instead of SDSL in almost all instances, so it can also be considered TLS stripping.

Question 5

ARP Poisoning

Answer 5

Attack that misleads computers or switches about the actual MAC address of a system.

ARP resolves IP addresses to their hardware address (MAC) and store the results in an area of memory known as the ARP cache.

ARP is very trusting and launches an ARP request and will believe in any ARP rely, so an attacker can easily create an ARP reply packet with a spoofed or bogus MAC address and poison the ARP cache on systems in the network.

-Commonly used for MITM and DoS attacks (ie impersonating a gateway so no traffic leaves a network).

Question 6

MAC Flooding

Answer 6

An attack against a switch that attempts to overload it with different MAC addresses associated with each physical port.

Sometimes a switch will run out of memory to store all of the MAC addresses and will enter a fail-open state, where instead of working as a switch it ends up operating as a hub, sending traffic to all switch ports.

*Switches commonly contain a flood guard to protect against MAC flood attacks, which can limit the amount of memory used to store MAC addresses for each port.

Question 7

MAC Cloning

Answer 7

Simply changing a system’s MAC address to another MAC address, often to fool an ISP into thinking that a different networking device isn’t different, meaning they might give you an IP addresses.

Question 8

DNS Poisoning

Answer 8

Attempts to modify or corrupt DNS data, such as modifying the IP addresses associated with espn.com and replace it with a malicious website.

If successful, and users attempt to go to espn.com, they will be sent to a malicious website instead.

*A primary indicator of a DNS poisoning attack is when users enter the URL of one website but are taken to a different website.

DNSSEC (Domain Name System Security Extensions) protects servers from DNS attacks.

Question 9

Pharming attack

Answer 9

Another attack that manipulates DNS name resolution process. It either tries to corrupt the DNS server or the DNS client, also redirecting a user to a different website.

This normally takes the form of modifying someone’s hostname mappings on their host computer.

Question 10

URL Redirection

Answer 10

Common technique used to redirect traffic to a different webpage within a site, or even a different site completely.

Attackers can use URL redirection for malicious purposes like sending traffic to a website.
–> You attempt to go to a website, and you’re redirected to another website.

Question 11

Domain hijacking

Answer 11

In a domain hijacking attack, an attacker changes a domain name registration without permission from the owner.
Attackers often do this with social engineering techniques to gather unauthorized access to the domain owner’s email account.

Question 12

DNS sinkhole

Answer 12

A DNS sinkhole is a DNS server that gives incorrect results for one or more domain names.

If the DNS server has a sinkhole for a domain name you won’t be able to access the site. Authorities have used sinkholes to disrupt botnets and malware, since botnets frequently check in with command and control servers, authorities have reversed engineered the domain names within the malware that direct traffic to that server and will redirect that traffic destined for those domain names.

Question 13

Replay attack

Answer 13

When an attacker replays data that was already part of a communication session.

Attacker first captures data sent over a network between two systems, modifies the data and then tries to impersonate one of the clients in the original session and send the modified data in session replays. Can occur on both wired and wireless networks.

Many protocols and systems such as Kerberos use timestamps and sequence numbers to thwart replay attacks.

Question 14

OWASP

Answer 14

Open Web Application Security Project

A non-profit foundation focused on improving the security of the software, including hundreds of local chapters that produce free documentation, tools and methodologies and techniques to improve web application security.

Question 15

Code reuse

Answer 15

Code reuse saves time and helps prevent coders from introducing new bugs. It’s the process of reusing tested code instead of creating brand new code for a similar application.

Question 16

Third party libraries and SKDs

Answer 16

These are popular methods of code reuse.

Libraries contain a wide assortment of prewritten and tested code that can be used for almost any purpose. They can include functions and other code snippets. Developers can add a line of code within a web app to reference a library available online, then call any of the library’s functions within their web app without needed to write the code from scratch.

SDKS are like third party libraries but are typically tied to a specific vendor, like Android when creating an Android app, you’d use a an Android SDK. SDKs include software tools that will help you create apps for Android-based devices. They also include a code library and much more, like tools for debugging an app, APIs, documentation and tutorials.

Question 17

Input validation

Answer 17

Input validation is the practice of checking data for validity before using it. It prevents an attacker from sending malicious code that an application will use by either sanitizing the input to remove the malicious code or rejecting the code.

This is one of the most important security steps that developers should adopt as a secure coding practice.

*Improper input handling (or lack of input validation) is one of the most common web app security issues and allows buffer overflow attacks, SQL injections, dynamic link library (DLL) injections and cross-site scripting attacks.

Question 18

What are some common checks performed by input validation?

Answer 18

1. Verifying proper characters
   -Some fields like a zip code should only use numbers while state should only include letters, others hybrid. Developers can configure input validation code to check for specific character types and verify they are entered correctly.
2. Blocking HTML code
   -Some malicious attacks like XSS embed HTML code with the input as part of an attack. Input validation code can detect HTML code such as the < and > characters and not use it.
3. Preventing the use of certain characters
   -Attacks like SQL injections use specific characters such as the dash (-), apostrophe (‘), and equal sign (=) so blocking these helps to prevent these attacks.
4. Implementing boundary or range checking
   -These checks ensure that values are within expected boundaries or ranges, such as if the max purchase for a product is 3, it checks that the quantity is 3 or less. This identifies when data is outside the range and the application doesn’t use it.

Question 19

Client-side vs. server-side input validatioon

Answer 19

Client-side execution indicates that the code runs of the client’s system, such as a user’s web browser, while server-side execution indicates the code runs on the sever, such as on a web server.

• Client side input validation is quicker but is vulnerable to attacks. Server-side input validation takes longer but is secure because it ensures the application doesn’t receive invalid data. Many apps use both

In client-side input validation, the validation code is included in the HTML page sent to the user. If he enters a quantity outside the boundaries, the HTML code gives him an error message and doesn’t submit the page to the server until the user enters the correct data.
-However it’s possible to bypass client-side validation, as many browsers allow you to disable JavaScript in your web browser, and you can also use a web proxy to capture the client’s data in the HTTP POST command and modify it before forwarding it to the server.

Server-side input validation checks the inputted values when reaches the server, ensuring that the user hasn’t bypassed the client-side checks.

Using both provides speed and security.

Question 20

Race condition

Answer 20

When two or more modules of an application, or two or more applicatoons, attempt to access a resource at the same time, it can create a conflict known as a race condition. Most developers know about this and input methods to avoid this but if ignored by a new developer these can cause significant problems.

EXAMPLE: two people buying an identical airplane ticket online at the exact same time. A good coding design is to:
-Lock the selection before offering it to a customer
-Double check for a conflict later in the process.
-Databases often have concurrency processes to prevent entities from modifying a value at the same time.

Question 21

TOCTOU

Answer 21

Time of Check to Time to Use (TOCTOU) is a type of race condition, sometimes called a state attack.

Attacker tries to race the OS to do something malicious with data after the OS verifies access is allowed (time of check) but before the OS performs a legitimate action at the time of use.

Question 22

Proper error handling

Answer 22

ERRORS TO USERS SHOULD BE GENERAL, NOT DETAILED

Detailed error information should be logged for internal use.

Error and exception handling helps protect the OS’s integrity and controls the errors shown to uses. Apps should show generic error messages to users but log detailed information.

Question 23

Compiler

Answer 23

Converts code written in a programming language into a binary executable file. It checks the program for errors and provides a report of items developers might like to check. Common compiled languages include C++, C#, and Java.

Automated software diversity is sometimes used to mimic the use of multiple different core languages. It also adds a level of randomness to the code allowing the same program to behave slightly differently on different systems but still achieving the same result.

A program written in C# and compiled with this multicompiler would create a binary executable that includes all the functions and modules of the code as if it was written in C# and any number of other languages.

The idea is that this automated diversity provides an added layer of protection, as an attack that succeeds on one system would fail on another system using the same multicompiled program.

Question 24

Secure cookie

Answer 24

When a user visits a website the site often creates a cookie and writes it to the user’s system - the cookie is a small text file and can include anything the web developer chooses to write. When the user returns to the site, the web app reads the cookie and uses it to enhance the user experience.

However, attackers have at times read the cookies and exploited various vulnerabilities.

*A SECURE COOKIE is one that has a Secure attribute list, which ensures that the cookie is only transmitted over secure channels such as HTTPS, which protects the confidentiality of the cookie’s contents and prevents attackers from reading them,

Question 25

Static vs dynamic code analysis + fuzzing

Answer 25

• Static code analysis examines the code without executing it. A developer performing a manual code review goes through it line by line to discover vulnerabilities, and can also use automated tools.
• Dynamic code analysis checks the code as it is running. A common method is to use FUZZING.

Fuzzing: uses a computer program to send random data to an application. In some cases, the random data can crash the program or create unexpected results, indicating a vulnerability; the goal is to discover problems before releasing the application.

Question 26

Sandboxing

Answer 26

A term used to test applications within an isolated area specifically created for testing. Developers test apps in a sandboxes often via Virtual Machines.

Question 27

Secure Development Environment (stages)

Answer 27

1. Development
2. Test
3. Staging
4. Production
5. Quality Assurance (QA)

Question 28

Normalization (databases)

Answer 28

Normalization of a database refers to organizing the tables and columns to reduce redundant data and improve overall data performance.

It is the process used to optimize databases. A database is considered normalized when it conforms to the first three normal forms.

1. FIRST NORMAL FORM
   - Each row within a table is unique and identified with a primary key
   -Related data is contained in a separate table
   -None of the columns contain repeating groups
2. SECOND NORMAL FORM
   -Non-primary key attributes are completely dependent on the composite primary key.
3. THIRD NORMAL FORM
   -All the columns that aren’t primary keys are only dependent on the primary key, ie. none of the columns in the table are dependent on non-primary key attributes.

Question 29

SQL Injection

Answer 29

Attack where an attacker enters additional data into the webpage form to generate different SQL statements.

SQL query language uses a semicolon (;) to indicate the SQL line’s end and use two dashes (–) as an ignored comment. The (*) is a wildcard and returns all columns in a table.

If an app doesn’t include error-handling routines and instead provides details about the type of database the app is using such as Oracle, Microsoft SQL Server, or MySQL database. Different databases format queries slightly different so once the attacker knows the brand they can follow the appropriate statements to read, modify, delete and/or corrupt the data.

*Many SQL injection attacks use the phrase of OR = ‘1’ = ‘1’ to create a true condition.

-SQL injections attacks often start by sending improperly formatted SQL statements to the system to generate errors, so proper error handling is crucial.

Question 30

Stored procedures

Answer 30

A stored procedure is a group of SQL statements that execute as a whole, similar to a mini program. A parameterized stored procedure accepts data as an input called a parameter. Instead of copying the user’s input directly into a SELECT statement the input is passed to the stored procedure as a parameter.

The stored procedure performs a data validation, but it also handles the parameter (the inputted data) differently and prevents a SQL injection attack.

Question 31

Provisioning and deprovisioning

Answer 31

Typically defers to user accounts - admins create an account and give appropriate privileges when someone joins the company. Deprovisioning means removing access to these resources and can be as simple as disabling or deleting the account.

Question 32

DevOps + its processes

Answer 32

Development Operations models such as DevOps use several specific software development processes to automate code development, such as:

-Automated courses of action
-Continuous monitoring
-Continuous validation
-Continuous integration
-Continuous delivery
-Continuous deployment

Question 33

Identifying malicious code and scripts

Answer 33

-You can’t update the system
-Antivirus software is disabled
-A system runs slow than normal
-Internet traffic increases on its own
-Programs appear to start on their own
-A system randomly crashes or freezes
-Pop-ups or security warnings begin to appear
-Your browser home page or default search engine changes
-A ransom demand appears along with the inability to access data or a system

Question 34

PowerShell

Answer 34

Windows PowerShell is a task-based command-line shell and scripting language using cmdlets that allows you to enter commands directly.

Just as you can create and run batch files (.bat) composed of multiple commands, you can also create PowerShell script files (.ps1) composed of multiple PowerShell commands.

Best way to detect a PowerShell cmdlet is by viewing logs. They use a verb and noun pair, Invoke-Command cmdlet, such as Get, Add, Test, Remove.

PowerShell has full access to the Microsoft Component Object Model (COM) and Windows Management Instrumentation (WMI) which gives it a lot of power within a Windows-based network.

Question 35

Bash

Answer 35

Short for Born-Again Shell, is a command language interpreter for Unix and Unix-like OSs. When you run a command on the Linux terminal you are using the bash interpreter.

You can create a script file with several bash commands and invoke the script file, just as you can create a batch file and run all the commands within a batch file.

However, when running a bash script file you must prefix it with bash or sh command or the full path as /bin/bash or /bin/sh.

bin/bash mytest.sh or /bin/sh mytest.sh if not in the current directory, you would need to use the full path.

If logs show verb-noun cmdlets or calls to bash or sh, it may be a potential attack indicator.

Question 36

Macros

Answer 36

A macro is a short instruction that will run a longer set of instructions, and are very helpful at automating repetitive functions.

Question 37

VBA

Answer 37

Visual Basic for Applications, created by Microsoft, runs as an internal programming language within Microsoft applications such as Word.

Is an event-driven tool and functions created within VBA are started by initializing macros. Macros are disabled by default since it’s easy for attackers to create malicious macros and VBA code.

Question 38

OpenSSL

Answer 38

OpenSSL is a software library used to implement SSL and TLS protocols, accessible via the terminal in Unix-like systems such as Linux.

Used to create key pairs before requesting a certificate.

Question 39

SSH

Answer 39

You can launch SSH (Secure Shell) protocol to connect with remote systems from the command prompt or terminal be entering the ssh command.

OpenSSH is a suite of tools that simplify the use of SSH such as being able to create a passwordless login.

Question 40

atta

Question 41

Zero-Day Attack

Answer 41

A zero-day vulnerability is a weakness or bug that is unknown by trusted sources such as the developer, antivirus and operating system vendors.

A zero-day attack exploits an undocumented vulnerability unknown to the public. The vendor might know about it but has not yet released a patch to address it.

The best indicator of a zero-day attack is erratic or unexpected behavior on an attacked system.

Question 42

Memory leak

Answer 42

A bug in a computer application that causes the application to consume more and more memory the longer it runs. In extreme cases it can consume so much memory that the OS crashes.

Typically caused by an application that reserves memory for short-term use but never releases it.

Question 43

Buffer overflow

Answer 43

A buffer overflow occurs when an application receives more input or data, or a different input, than it expects, which exposes system memory.

The result is an error that exposes the system memory that would otherwise be protected and inaccessible.

Normally an application will only have access to a specific area of memory called a buffer. The buffer overflow allows access to memory locations beyond the application’s buffer, enabling an attacker to write malicious code into this memory area.

NOP (“no-op”) = no operation command, written as NOP slide or NOP slide, often a string of x90 characters to create a NOP command. Log entries showing a string of NOPs or x90 characters are an indicator of an attempted buffer overflow attack.

These attacks often include NOP instructions (such as x90) followed by malicious code, which when successful causes the system to execute the malicious code.

Error handling and input validation, plus applying patches quickly all help prevent this.

Question 44

Integer overflow

Answer 44

Occurs if an application receives a numeric value that is too big for the application to handle. The result is the app gives inaccurate results.
EX: if an app reserves 8 bits to store a number is can store any value between 0 and 255, so any operation creating a value above that will result in an integer overflow.

It’s a good practice to check the size of the memory buffers to ensure they can handle any data generated by applications .

Question 45

Pointer/Object Dereference

Answer 45

In C++ and C#, setting an object to null and trying to use it at run time can cause a memory leak. It’s easy to identify the program causing a memory leak, but hard to find the code within the application causing the memory.

Best way to avoid the problem within an application’s code is by performing a simple check to verify a value is not null before using it. If an app is causing memory leaks it’s worthwhile to verify the application is performing null checks.

*In Java the compiler will typically catch null references objects and throw a NullPointerException error.

Question 46

DLL Injection

Answer 46

Applications commonly use a Dynamic Link Library (DLL) or multiple DLLs.

A DLL is a compiled set of code than an application can use without re-creating the code.

EX: most programs use math-based DLLs where instead of writing the code to discover a number’s square root, a developer can include the appropriate DLL and access the square root function within it.

*A DLL Injection attack injects a DLL into a system’s memory and causes it to run.

-EX: an attacker could create a DLL named malware.dll that includes several malicious functions. In a successful DLL injection attack, the attacker attaches this malicious DLL to a running process, allocates memory within the running process, connects the DLL within the allocated memory, and then execute functions within the DLL.

Question 47

LDAP Injection

Answer 47

LDAP specifies the formats and methods used to query databases of objects such as users, computers and objects within a network - ie Microsoft AD uses LDAP to access objects within a domain.

An LDAP injection is sometimes possible when a web app is used to query an LDAP-based database.

EX: a help-desk technicians needs to access a user account to modify it, thus enters their username into the app, and the app crafts an an LDAP query to retrieve the user’s account info.
-Imagine the tech uses the app to enter more than just the user’s username; it may be possible to trick the app into crafting a longer LDAP query and access more than just the user’s info.

*Best way to prevent this is by validating the input.

Question 48

XML Injection

Answer 48

Extensible Markup Language (XML) is a markup language commonly used to transfer data. It’s extensible meaning it supports the use of any user-defined tags to describe data. Many online apps use XML to transfer data.

Without input validation an attacker could for example create a second user account, where an XML receiving the data creates a second account but ignores the first account.

A primary indicator of an XML injection is the creation of unwanted accounts, but it may take detailed logging and auditing to discover this. Input validation thwarts this.

Question 49

Directory traversal

Answer 49

A specific type of injection attack that attempts to access a file by including the full directory path or traversing the directory structure on a computer.

EX: the passwd file is normally stored in the /etc/passwd directory path. Attackers can use command including the path to the file to read it, or use a remove directory command (such as rm -rf) to delete a directory, including all files and subdirectories.

Input validation prevents this.

Question 50

XSS

Answer 50

Cross-site scripting (XSS is a web app vulnerability that allows attackers to inject scripts into webpages. The CWE lists the weakness as “improper neutralization of input during webpage generation (cross-site scripting”.

XSS attacks start by entering untrusted data in a web app, usually in one of two ways:

1. Reflected XSS or non-persistent:
   Started by an attacker crafting a malicious email and encouraging a user to click it. The malicious URL is often placed within a phishing email, but can also be placed on a public website such as a link with a comment.
   –> When the user clicks the malicious URL, it sends an HTTP request to a server. This request includes malicious code and the server sends it back to the user in an HTTP response.
2. Stored XSS or persistent:
   Instead of the user sending the malicious code to the server, it is stored in a database or other location trusted by the web app. The web app can retrieve the malicious code later such as when an admin logs onto the website.

*Primary protection is signification input validation techniques for the web app, avoiding any methods that allow the webpage to displayed untrusted data. OWASP also recommends the use of a security encoding library, which sanitizes HTML code and prevents XSS attacks.

TLDR: XSS attacks allow attackers to capture user information such as cookies, and can be prevented via input validation.

Question 51

XSRF or CSRF

Answer 51

Cross-site Request Forgery is an attack where an attacker tricks a user into performing an action on a website. The attacker creates a specially crafted HTML link, and the user performs the action without realizing it.

If a website supports any action via an HTML link, an attack is possible, including making purchases, changing passwords, transferring money and more.

Websites normally won’t allow these actions without a user first logging on. But if users have logged on before, authentication info is stored on their system either in a cookie or the web browser’s cache. XSRF can sometimes allow attackers to access the user’s password if a site automatically uses the cookie info to log users on as soon as they visit.

Using a CAPTCHA (Completely Automated Public Turing Test to Tell Computers and Humans Apart) forces a user to interact with the site and prevents an automated action by a malicious link.

You can also use dual authentication and force the user to manually enter credentials prior to performing actions.

Some languages use CSRF tokens in any page that includes a form, a random number generated each time the form is displayed.

TLDR: CSRF attacks often include a question mark to modify a URL.

Question 52

SSRF

Answer 52

Server-Side Request Forgeries exploit how a server processes external information.

-EX: some web apps read data from an external URL and use it when creating the webpage, so if an attackers modifies the external URL. he can potentially inject malicious code into the webpage. Other external data sources include API data, databases, and files.

SSF attacks have allowed attackers to exfiltrate data, such as in the Capital One data breach of 2019.

Question 53

Client-side request forger

Answer 53

Occur if an attacker can inject code into the client-side web pages after the server has crafted it and sent it to the user. The most common way is using cookies, where an attacker modifies existing cookies that the web app expects to read on the client, injecting malicious code into the cookies, which will then be placed into the web page on the client side.

Question 54

Driver manipulation

Answer 54

OSs user drivers to interact with hardware devices or software components, ie when you print a page in Word, Word accesses the appropriate print driver via the Windows OS. The OS also typically access software driver to decrypt data so you can view it.

Question 55

Shimming

Answer 55

Provides a solution that makes it appear that older drivers are compatible with each other, such as when an app needs to support an older drive, ie Windows 10 with Windows 8.

A driver shim is additional code that can be run instead of the original driver. When the app attempts to call an older driver, the OS intercepts the call and redirects it to the shim code instead.

Question 56

Refactoring

Answer 56

Refactoring code is the process of rewriting the code’s internal processing without changing its external behavior, and is usual done to correct problems related to software design.

When a driver is no longer compatible developers can either write a shim to provide compatibility or completely rewrite the driver to refactor the relevant code.

Attackers with strong programming skills can manipulate drivers by creating shims or rewriting internal code. They can fool the OS into using a manipulated driver then cause it to run malicious code contained within the manipulated driver. However manipulating drivers can often cause unintentional problems with the device or software component the driver uses.