Vulnerabilities of data transmission

Question 1

Sniffing Attack(property)

Answer 1

Tapping network traffic or routing traffic to a target where it can be captured, analysed and monitored

Question 2

Sniffing Attack(Why problem, or why important?)

Answer 2

Because any network packet having information in plain text can be intercepted and easily read by attackers. Connecting to public networks will have this risk

Question 3

Sniffing Attack(Give an example, or give a definition)

Answer 3

This information could be usernames, passwords, secret codes, baking details or any information which is of value to the attacker

Question 4

Sniffing Attack(Describe a measure to prevent)

Answer 4

Encrypting data to ensure all data that leaves the system can not be read even if the traffic is being sniffed(hackers could run cryptographic attacks to get something out of the data though). The use of secured protocols ensures the traffic is encrypted and renders security for traffic.

Networks should be scanned for any kind of intrusion attempt or rogue devices that may be set up to capture traffic. Network admins should monitor network devices as well to ensure they are authorised and have not been infected

Question 5

Man in the middle attack(property)

Answer 5

Victim, the Entity with which the victim is trying to communicate, the man in the middle(who is intercepting the victim’s communications)

Question 6

Man in the middle attack(Why a problem or why important)

Answer 6

Interception - attackers look to gain access to a poorly secured Wi-Fi router, can scan router looking for specific vulnerabilities such as weak password. Once they find vulnerability they can exploit it by deploying tools to intercept and read victims transmitted data(logins, bank info etc.)
Decryption - Victims intercepted data must then be unencrypted, so that attacker can read and act upon it

Question 7

Man in the middle attack(give an example, or give a definition)

Answer 7

MITM sent you an email, making it appear legit(phishing)
MITM created a website that looks like a banks website, so you wouldn’t hesitate to enter your login credentials after clicking the link in the email

Question 8

Man in the middle attack(Describe a measure to prevent)

Answer 8

Make sure HTTPS is in website.
Be wary of phishing emails
Avoid direct connections to public Wi-Fi routers(use a VPN)
Internet security should be installed on systems
Be sure that home Wi-Fi networks are secure

Question 9

Spoofing attacks(property)

Answer 9

When an attacker impersonates another device or user on a network in order to launch attacks against network hosts, steal data, spread malware or bypass access controls

Question 10

Spoofing attack(give example or definition)

Answer 10

Common spoofing attack methods:
IP address
ARP
DNS server
HTTPS

Question 11

Spoofing attack(measure to prevent)

Answer 11

Packet filtering - inspect packets as they are transmitted across network
Useful in IP address spoofing attack prevention as they are capable of filtering and blocking packets with conflicting source address info

Avoid trust relationships(allow users in one domain to access resources in another domain) - protocols should be developed that they rely on these as little as possible
Easier for attackers because trust relationships only use IP addresses for authentication

Use spoofing detection software - work by inspecting and certifying data before its transmitted and blocking data appearing to be spoofed

Use cryptographic network protocols - TLS, SSH, HTTPS and other secure communications protocols bolster spoofing attack prevention efforts by encrypting data before its sent and authenticating data as its received

Question 12

IP Address spoofing

Answer 12

Every device capable of connecting to internet has IP address
By spoofing an IP address, an attacker can trick you into thinking your interacting with a website or someone you know, perhaps giving the attacker access to information you would otherwise not share

Question 13

ARP spoofing

Answer 13

Address Resolution protocol - used to resolve IP addresses to MAC addresses for transmitting. data
Attacker sends spoofed ARP messages across a LAN to link their MAC address with IP address of legit member of network
Results in. data that’s intended for the hosts IP address getting sent to the attacker instead

Question 14

DNS spoofing

Answer 14

Malicious party modifies the DNS server in order to reroute a specific domain name to a different IP address

Question 15

HTTPS spoofing

Answer 15

Attacker can fool a users browser into believing its visiting a trusted website when its not.
By redirecting the users browser to an unsecured website, the attacker can monitor the users interactions with that website and possibly steal personal info that they are sharing

Question 16

Replay Attacks(property)

Answer 16

Occurs when an attacker intercepts and then delays or resends a secure data communication to misdirect the receiver into doing what the attacker wants

Question 17

Replay Attacks(why problem or why important)

Answer 17

Attacker doesn’t even need advanced skills to decrypt the data communication after capturing it from the network.
Attacker could be successful simply by delaying or resending the whole thing

Question 18

Replay attack(give example or definition)

Answer 18

Alice wants to request that bob transfers £1000 to Alices account
Alice sends a legit message to bob to request transfer
Bob believes the request from Alice is legit and sends £1000 to alices account(but alices legit message was intercepted)
The attacker resends Alices message to bob
Bob believes the 2nd request from Alice is legit and sends another £1000
This time, the attacker is able to divert the £1000 sent by bob into their own account

Question 19

Replay attack(measure to prevent)

Answer 19

Both sender and receiver should establish random session keys that are valid for one transaction only and cannot be used again.

Adding timestamps to all messages prevents attackers from resending messages sent longer ago than a certain length of time, thus reducing window of opportunity for an attacker to eavesdrop, siphon off the message and then resend it

Use a OTP for each transaction that’s only used once and discarded. Esnure that even if a message is duplicated and resent by an attacker, the encryption code has expired and no longer works