Intro

In this lesson, we explore attacks against networks, specifically those that leverage protocols across the OSI layers. You can download the script for this video from above or at the end of the video.

Causes of network attacks

Network attacks are commonly enabled for threat actors for three basic reasons. First, organizations do not always configure protocols beyond their default configurations. Threat actors understand the often well-known weaknesses this exposes. Related to misconfiguration is a failure to understand protocol vulnerabilities that are part of certain protocols. Threat actors understand these vulnerabilities, so security teams must ensure that the vulnerabilities are dealt with directly or with compensating controls. Finally, application and browser vulnerabilities provide additional attack vectors. Keeping them patched or managed in other ways helps reduce associated risk.

Denial of Service Attacks

A threat actor launching a denial of service attack is attempting to shut down server or network functionality. Two ways of accomplishing this are through SYN floods or surfing attacks.

SYN flood attack

SYN flooding uses the TCP handshake to stop a server from establishing sessions. Let's start with how the handshake is supposed to work. In this example, a laptop wants to establish a session with a web server. The session initiation begins when the laptop sends a SYN packet to the server. The server then reserves a connection and returns a SYN/ACK packet. It also places an open request on the backlog queue. The laptop returns an ACK packet, which causes the server to establish a session with the laptop. Denial of service happens when the number of open requests exceeds the server's ability to manage them. In a SYN flood, a threat actor takes advantage of the request limitation as follows. The threat actor sends a SYN packet to the server. The server opens a connection request and sends a SYN/ACK packet. However, the threat actor does not return an ACK packet. Instead, he continuously sends SYN packets without a final ACK. This quickly stresses resources to the point that the server can no longer support connections.

Simple DOS SYN flood defense

Organizations can effectively defend against SYN flooding in simple denial of service attacks by performing some of the following. Implementing IPS to detect and block anomalous behavior. Implementing a network behavior analytics solution. Configuring rate limiting on devices that support them. Rate limiting controls the frequency of requests allowed on OSI layers 4 and 5. Expanding the number of open TCP requests available by increasing the size of the backlog queue. The backlog queue contains a list of open connection requests and it is limited in size. Increasing the size of the queue takes resources away from other server functions, so care must be taken when doing this. Configuring first in and first out. When this is in place, the oldest open request is overwritten when the maximum number of requests is reached. This may allow some connections, but it will be intermittent and not nearly enough for normal business operation. We'll see why when we look at distributed denial of service attacks. SYN cookies remove open requests from the backlog queue and place them in cookies. The cookie content is used when the requester sends its final ACK packet. This helps keep the backup queue clear, and finally, coordinating with ISPs to develop and test a denial of service response plan. Before looking at Smurf attacks, we need to understand denial distributed denial of service attacks or DDoS.

Distributed denial of service (DDoS)

DDOS attacks use thousands, or hundreds of thousands, of recruited systems to launch attacks. In a DDoS SYN flood attack, a threat actor would cause each member of a bot army to send SYN packets to the target server. The effect would be fast and massive enough to make most of the defense steps we discussed previously ineffective. As shown, DDoS attacks are typically launched by botmasters who have installed malware on the endpoint devices, including IoT, that enrolls the infected devices into a bot army. The bot army is controlled by a command and control server. Now let's look at Smurf attacks.

Smurf attack

Smurfing uses the internet control message protocol or ICMP to flood server and network resources. A basic Smurf attack occurs when a threat actor floods the target network with ICMP ping request packets. The source request for the request packets is the network's broadcast address. The network is unusable as ping packets and their responses use available resources. An advanced Smurf attack starts as a basic attack, but the ping requests are configured to respond to multiple victims across the internet.

DDoS Defense

DDoS defense requires taking steps to detect and respond. It also requires ensuring that on-premises devices remain free of bot malware. Ping attacks are still possible, but best practice security configurations stipulate blocking ICMP traffic at key points, especially between the external and internal networks. Three other DDoS attacks that use ICMP include ping of death, ping flooding, and Fraggle.

Ping of death

In a ping of death attack, a threat actor sends ping packets with a packet size larger than the target system can handle. The target system crashes as it attempts to manage them.

Ping flooding

Ping flooding overwhelms the target system with a large number of ping packets.

Fraggle attack

Fraggle is a type of Smurf attack that uses UDP echo packets instead of SYN packets.

Teardrop attack

Another network protocol attack that can cause denial of service is the teardrop attack, which occurs at layer 3 in the OSI model. In a teardrop attack, the threat actor sends malformed packets that can overwhelm the target device as it attempts to manage the packets. Now let's move on from denial of service to other types of network attacks.

Man-in-the-middle

Man-in-the-middle attacks are common attack vectors. Fundamentally, a man-in-the-middle attack happens when a user attempts to connect to a resource and is intercepted by a threat actor. The threat actor then connects to the resource. As the victim interacts with the intended resource, the threat actor collects all packets sent or received from the target resource, and then forwards them on. It appears to the victim as if she is connected directly to the intended resource. To launch a man-in-the-middle attack, a threat actor can leverage tools, techniques, and procedures, such as network sniffing, credential spoofing, and eavesdropping.

Man-in-the-middle defense

There are two primary ways an organization can defend against man-in-the-middle attacks: authentication and tampering detection. Authentication includes use of TLS with certificates to keep the session secure, Forcing both the user device and the server, in this case, to authenticate with each other would prevent the threat actor from eavesdropping or establishing a connection with the server. In tamper detection, an organization can use tools to examine the latency in transactions. If the latency exceeds expectations based on baselines, the organization can drop the connection or initiate a response.

Packet sniffing

Packet sniffing can be done on any network or network segment that is not encrypted. This is a common attack vector on public networks; this is a big reason to require TLS or IPSec VPN for mobile users to authenticate and interact with cloud and data center resources. Threat actors can collect sensitive data, but they also use packet sniffing as part of the information-gathering phase of an attack, including what is being accessed and how. Packet sniffing can also help enumerate and map the network. A threat actor using packet sniffing can only see the traffic on the network connection to which he is connected. Segmentation is a good control to reduce packet sniffing attacks. Another important safeguard is preventing physical access to open, active network ports and the connection of rogue devices. Fnally, packet sniffing is always minimized or eliminated when all network traffic is encrypted with approaches like TLS or IPSec.

Session hijacking

The term hijacking attack is an umbrella term for various types of man-in-the-middle attacks. They include any attack that exploits an open session. Session access is often managed by a cookie or another type of token. A threat actor can intercept or eavesdrop to gain control of the session token or cookie. In this example, the threat actor sniffed a cookie Adam is using for access to the remote system. Once the threat actor has the cookie, she can use it to access the same remote system as Adam. The threat actor can also use the cookie to terminate Adam's session, so that the remote system only sees what appears to be a single authenticated session. This can also happen if a session token is stolen by a threat actor. Well, that's it for this lesson. If you have questions, please ask. ...and until next time be careful once you click.

Outro

you