Module2: Denial of Service and Social Engineering Flashcards
Why are DoS attack considered so ‘nasty’?
- One of the easiest attacks to launch
- Hard to trace the attacker
- Solving the attack often involves shutting down the service - self DoS
What are the two types of DoS attacks?
- Flooding DoS attack
- Logic DoS attack
What is a flooding DoS attack?
Flood of real-looking but unnecessary data so that its resources are consumed.
What is a logic DoS attack?
Exploit the vulnerabilities of the target intelligently
What are the 10 types of DoS attacks?
- ping Flood
- TCP/SYN attack
- Land attack
- Other TCP attacks
- Tear drop attack
- Ping of death
- Smurf attack
- UDP Flood
- HTTP verb attacks
- SSL-based DDoS attacks
- Botnet based DDoS attack
What is a DoS ping attack?
Send large ‘pings’ to a server non-stop
What is a DoS TCP-SYN attack?
Victim is flooded with spoofed TCP SYN requests
What is a DoS Land attack?
Attacker sends a TCP SYN segment that has been tweaked so that the source IP address and the destination IP address are both that of the victim machine.
What is a DoS tear drop attack?
An attacker repeatedly fragments IP packets, sends all but one packet to the destination.
What is a DoS ping of death attack?
Fragmented ping packet - breaks several systems vulnerable to this attack.
What is a DoS smurf attack?
ICMP echoes on a network are redirected to the victims host. The ICMP echo was tweaked with source IP = the victims IP.
What is a DoS UDP flood?
Spams all ports with UDP requests for ICMPs
What is a DoS HTTP Verb attack?
Make several get requests from a single page
What is a DoS SSL-based attack?
- SSL connections are heavy
- Make several requests to high-load sections of the website
What is a DoS botnet attack?
Deploy a botnet to attack a host with a SYN attack - Mirai is an example.
How can you prevent DoS attacks?
- Block invalid requests
- Whitelist IP addresses
- CAPTCHA
- Match incoming requests (counter-attack)
- Backup
- DDoS protective service
- Redundancy
What are the four social engineering ‘tricks’?
- Impersonation
- Ingratiation (appeal to vanity)
- Diffusion of responsibility (convince that information has been given by other people in the company)
- Plain old friendliness (appeal to the helpful nature)
What is dumpster diving?
Collect information from company’s trash.
What is social engineering by phone?
Call up and imitate someone.
What is shoulder surfing?
Watch over your shoulder and get information.
What is baiting?
Send legit email - get user’s information
What is phishing?
Legit looking email to extract information from user
What is pharming
altering DNS poisoning
What is phlashing?
Permanent DoS
What is reverse social engineering?
Get the victim to contact the attacker
How can you mitigate social engineering attacks?
- Education
- Policies
