vulnerabilities of data transmission Flashcards
1
Q
Sniffing attack
A
- a sniffing attack refers to tapping network traffic or routing the traffic to a target where it can be captured, analysed, and monitored.
2
Q
Sniffing attack defences
A
- Connect to trusted networks
- Encrypt data
- Network scanning and monitoring
3
Q
Connect to trusted networks
A
- Connecting to any public network will have a risk that the traffic might be sniffed.
- Attackers choose these public places exploiting the user’s lack of knowledge.
- Public networks are setup and then may or may not be monitored for any malicious activity.
4
Q
Encrypt Data
A
- Encrypt all data that leaves a system to ensure that even if the traffic is being sniffed, an attacker will not be able to read it.
- Encrypting the data does not mean that now everything is safe.
- An attacker might be able to capture a lot of data and run cryptographic attacks to get something out of it.
5
Q
Network scanning and monitoring
A
- Networks should be scanned for any kind of intrusion attempt or rogue devices that may be set up in to capture traffic.
- Network administrators should monitor network devices as well to ensure they are authorised and have not been infected.
6
Q
Man in the middle attack - Involves
A
- The victim.
- The entity with which the victim is trying to communicate.
- The man in the middle (MITM) who’s intercepting the victim’s communications.
7
Q
what you think happened
A
- You receive an email from your bank, asking you to log in to your account to confirm your contact information.
- You click on a link in the email and are taken to your bank’s website, where you log in and perform the requested task.
8
Q
what actually happened
A
- The MITM sent you the email, making it appear to be legitimate.
- The MITM also created a website that looks just like your bank’s website, so you wouldn’t hesitate to enter your login
credentials after clicking the link in the email. - But when you did that, you’re not logging into your bank account, you’re handing over your credentials to the attacker.
9
Q
Man in the middle phases
A
- Interception
- Decryption
10
Q
Interception
A
- With a traditional MITM attack, attackers will look to gain access to an unsecured or poorly secured Wi-Fi router.
- Attackers can scan the router looking for specific vulnerabilities such as a weak password.
- Once attackers find a vulnerability, they can exploit it by deploying tools to intercept and read the victim’s transmitted data.
11
Q
Decryption
A
- The victim’s intercepted data must then be unencrypted, so that the attacker can read and act upon it.
- BUT, most of the data we have been dealing with is sent unencrypted to and from the server and client!
12
Q
Man in the middle defences
A
- Make sure HTTPS is always in the URL bar of websites being visited, e.g., https://www.google.com/
- Be wary of potential phishing emails from attackers asking to update passwords or any other login credentials.
- Direct connections to public Wi-Fi routers should be avoided if possible.
13
Q
Spoofing attack types
A
- IP address spoofing
- ARP spoofing
- DNS server spoofing
- HTTPS spoofing
14
Q
IP address spoofing
A
- Every device capable of connecting to the internet has an internet protocol (IP) address similar to your home address.
- An attacker can trick you into thinking you’re interacting with a website or someone you know, perhaps giving the attacker access to information you would otherwise not share.
15
Q
Address resolution protocol (ARP) spoofing
A
In an ARP spoofing attack, an attacker sends spoofed ARP messages across a local area network in order to link their MAC address with the IP address of a legitimate member of the network.
