1.4 Given a scenario, analyze potential indicators associated with network attacks.

Question 1

What is a rogue access point and how to mitigate its affect.

Answer 1

Unauthroized WAP.
Maybe added by employee or an Attacker
Not malicious all the time
Very easy to plug in a WAP
Schedule Periodic Survey to check all WAPs.
Consider using 802.1x(Network Access Control

Question 2

What is a Wireless Evil twin

Answer 2

Wireless version of phishing.
Attacker may use a similar SSID name to trick users into connecting to the evil twin.
Big issue for Wifi hotspots. Easy to fool
Always use HTTPS and a VPN when using public WIFI.

Question 3

What is BlueJacking

Answer 3

An attacker sends an unsolicited message to a victim’s machine, usually this is a mobile phone or tablet, and the attacker is sending this message over Bluetooth. This does not use the cellular frequencies from a mobile carrier or 802.11 networks. It’s exclusive to using the Bluetooth communications channel.
The attacker would need to be relatively close to the victim’s machine to be able to send these Bluejacking messages since Bluetooth is only effective within 10 meters.

Question 4

What is blue snarfing

Answer 4

When an attacker can access data that’s on your mobile device using the Bluetooth communications channel, using Bluesnarfing, an attacker would be able to access contact lists, emails, calendar information, or any other data you might keep on that mobile device. Old concerns from 2003, a modern device will not be susceptible to this.

Question 5

What is RFID and what it stands for

Answer 5

Radio frequency identification
NFC is a type of RFID. Has same vulnerability as any wireless communication has as it is free and in clear.

Question 6

What is a nonce?

Answer 6

Arbitrary number used once. Used in cryptography. A “sAlt” is considered a nonce.

Question 7

What is an On-PAth attack

Answer 7

an attacker that sits in the middle between two stations and is able to intercept, and in some cases, change that information that’s being sent interactively across the network. This is a type of attack that can occur without anyone knowing that anyone is sitting in the middle of the conversation.
Referred to as a Man-in-the-middle attack.

Question 8

What is ARP poisoning?

Answer 8

On-Path attack on the local IP subnet.
This is an Address Resolution Protocol poisoning. And that’s because ARP, as a protocol, does not have any type of security associated with it. Devices receive and modify ARP tables without any type of authentication or any type of encryption. This would allow an attacker to send ARPs to any device on the local subnet, and those local devices would interpret the ARPs as if they were coming from a legitimate source.

Will lead to ARP Tables with wrong information which will relay all information to the attacker before it gets to or from the router. They will be “in-the-middle” of any communication in the network.

Question 9

What is an On-Path browser attack

Answer 9

Also known as man-in-the-browser attack.

A MitB attack occurs when the attacker compromises the web browser by installing malicious plug-ins, scripts, or intercepting API calls. Attackers can install vulnerability exploit kits on a website and will actively try to exploit vulnerabilities in clients browsing the site.

This type of attack has malware that’s running on the victim’s machine, and it’s usually not a person that’s handling the relay, but an automated process within the malware. Having malware on the same machine perform this on-path attack provides a number of advantages. Over the network, any encrypted data, even though it was proxied or relayed through a secondary device, would still be encrypted.

Question 10

What is Mac Flooding?

Answer 10

An attack that sends numerous packets to a switch, each of which has a different source MAC address, in an attempt to use up the memory on the switch. If this is successful, the switch will change state to fail‐open mode. Sends every frame to every interface on the switch. The switch has turned into a hub. Most switches have something called “Flood Guard” to prevent this.

Question 11

What is Mac cloning(Spoofing)?

Answer 11

Attacker changes their MAC address to match an existing MAC adress as a clone/spoof. disrupts communication to legitimate MAC. Easily manipulated via software.

Question 12

What is DNS poisoning?

Answer 12

• Modify host file located on each device, the host files takes precedence on each device when making a DNS query.
• Attackers can also modify DNS Server information on the legitimate DNS Server.
• Attacker could also send fake reponse to a valid DNS request to poison DNS

Question 13

What is domain hijacking?

Answer 13

Get access to domain registration and control where traffic flows. Using Brute force, social engineering etc.

Question 14

What is an IV attack

Answer 14

An Initialization Vector attack modifies the IV of an encrypted wireless packet during transmission to compute the RC4 keystream to decrypt all other wireless traffic. This attack becomes useless when WPA or WPA2 wireless protection is enabled.

Question 15

what is URL redirection

Answer 15

URL redirection refers to the use of HTTP redirects to open a page other than the one the user requested.

Question 16

What is an application attack

Answer 16

An application attack targets vulnerabilities in the headers and payloads of specific application protocols. For example, one type of amplification attack targets DNS services with bogus queries.

Question 17

Operational Technology Atack

Answer 17

An operational technology attack is a network attack that involves connections between embedded system devices. The term is “operational” because these systems monitor and control physical electromechanical components.

Question 18

What is Http Reponse splitting

Answer 18

HTTP Response Splitting occurs when the attacker would craft a malicious URL and convince the victim to submit it to the web server.

Question 19

Locally Shared Objects(LSO)

Answer 19

LSOs, or Flash cookies, are data stored on a user’s computer by websites that use Adobe Flash Player. A site may be able to track a user’s browsing behavior through LSOs.

Question 20

disassociation attack

Answer 20

A disassociation attack uses disassociation packets to remove a known wireless access point (WAP) from a client’s list of available networks. This is a type of DoS on wireless networks.

Question 21

deauthentication attack

Answer 21

A deauthentication attack sends a stream of spoofed frames to cause a client to deauthenticate. This is a type of DoS attack on wireless networks