Network Attacks Flashcards
Evil Twin
An Evil Twin attack involves an attacker setting up a rogue Wi-Fi access point with the same name (SSID) as a legitimate network. Unsuspecting users may connect to this rogue access point, thinking it’s the genuine network. Once connected, the attacker can intercept and manipulate the users’ network traffic, potentially capturing sensitive information like login credentials or injecting malicious content into web pages.
To defend against Evil Twin attacks, users should be cautious when connecting to Wi-Fi networks, especially in public places. It’s essential to verify the legitimacy of networks by checking SSIDs and using secure connections like VPNs when possible.
Network administrators can implement measures like wireless intrusion detection systems and strong encryption protocols to detect and mitigate Evil Twin attacks on their networks. Additionally, educating users about the risks of connecting to unknown networks and promoting secure Wi-Fi practices can help prevent successful attacks.
bluejacking vs bluesnarfing
Bluejacking: Bluejacking is a relatively harmless form of Bluetooth attack where an attacker sends unsolicited messages or files to Bluetooth-enabled devices, such as smartphones or laptops, within range. The goal of bluejacking is typically to send a humorous or promotional message to nearby users without their consent, rather than to steal data or compromise the device. Bluejacking exploits the Bluetooth protocol’s ability to send messages or business cards between devices without requiring pairing or authentication. While bluejacking can be annoying or disruptive to users, it generally does not pose a significant security risk, as it does not involve accessing or stealing data from the targeted devices.
Bluesnarfing: Bluesnarfing, on the other hand, is a more malicious Bluetooth attack that involves unauthorized access to a Bluetooth-enabled device to steal or extract data, such as contacts, messages, emails, or other personal information. Unlike bluejacking, which involves only sending messages or files, bluesnarfing exploits security vulnerabilities in the Bluetooth protocol to gain access to sensitive data stored on the targeted device. Bluesnarfing attacks often target devices with outdated or unpatched Bluetooth firmware, allowing attackers to exploit known vulnerabilities and extract data without the user’s knowledge or consent. Bluesnarfing poses a significant security risk to users, as it can result in the loss of sensitive information and compromise their privacy.
Cryptographic attack, 5 types of
A cryptographic attack is an attempt to compromise the security of a cryptographic system or algorithm by exploiting its weaknesses or vulnerabilities. Cryptographic attacks can target various aspects of a cryptographic system, including encryption algorithms, cryptographic protocols, key management systems, and implementation flaws.
There are several types of cryptographic attacks, including:
Brute-force attack: In a brute-force attack, the attacker tries every possible key or password until the correct one is found. This type of attack is particularly effective against weak or short keys and passwords but becomes increasingly impractical as the key size or password length increases.
Known-plaintext attack: In a known-plaintext attack, the attacker has access to pairs of plaintext and corresponding ciphertext and attempts to deduce the encryption key or algorithm from this information. This type of attack exploits weaknesses in the encryption process or algorithm to recover the key.
Chosen-plaintext attack: In a chosen-plaintext attack, the attacker can choose plaintext messages and observe the corresponding ciphertext produced by the encryption algorithm. By analyzing these pairs, the attacker attempts to deduce information about the encryption key or algorithm.
Man-in-the-middle attack: In a man-in-the-middle attack, the attacker intercepts and modifies communication between two parties, allowing them to eavesdrop on the communication or manipulate the data exchanged. This type of attack can compromise the confidentiality and integrity of the communication.
Side-channel attack: In a side-channel attack, the attacker exploits unintended information leakage from the cryptographic system, such as timing information, power consumption, electromagnetic radiation, or sound, to deduce information about the encryption key or algorithm.
Cryptographic attack, 5 types of
A cryptographic attack is an attempt to compromise the security of a cryptographic system or algorithm by exploiting its weaknesses or vulnerabilities. Cryptographic attacks can target various aspects of a cryptographic system, including encryption algorithms, cryptographic protocols, key management systems, and implementation flaws.
There are several types of cryptographic attacks, including:
Brute-force attack: In a brute-force attack, the attacker tries every possible key or password until the correct one is found. This type of attack is particularly effective against weak or short keys and passwords but becomes increasingly impractical as the key size or password length increases.
Known-plaintext attack: In a known-plaintext attack, the attacker has access to pairs of plaintext and corresponding ciphertext and attempts to deduce the encryption key or algorithm from this information. This type of attack exploits weaknesses in the encryption process or algorithm to recover the key.
Chosen-plaintext attack: In a chosen-plaintext attack, the attacker can choose plaintext messages and observe the corresponding ciphertext produced by the encryption algorithm. By analyzing these pairs, the attacker attempts to deduce information about the encryption key or algorithm.
Man-in-the-middle attack: In a man-in-the-middle attack, the attacker intercepts and modifies communication between two parties, allowing them to eavesdrop on the communication or manipulate the data exchanged. This type of attack can compromise the confidentiality and integrity of the communication.
Side-channel attack: In a side-channel attack, the attacker exploits unintended information leakage from the cryptographic system, such as timing information, power consumption, electromagnetic radiation, or sound, to deduce information about the encryption key or algorithm.
Downgrade attack
A downgrade attack is a type of security exploit where an attacker forces a system or communication channel to use older or less secure versions of cryptographic protocols or algorithms. This is done by intercepting and manipulating the communication between two parties to trick them into using weaker security mechanisms than they would normally use.
For example, in the context of secure communication over the internet, a downgrade attack might involve an attacker intercepting the negotiation process between a client and a server and modifying the communication to force the use of an older version of the TLS (Transport Layer Security) protocol, which may have known vulnerabilities or weaknesses.
How to Defend: To mitigate the risk of downgrade attacks, it’s important for systems to support only the latest and most secure versions of cryptographic protocols and algorithms, and for communication channels to use strong encryption and secure negotiation mechanisms. Additionally, implementing mechanisms such as certificate pinning and secure update mechanisms can help prevent attackers from downgrading security protocols and compromising the integrity and confidentiality of communication.
deauthentication attack
A deauthentication attack floods devices connected to a Wi-Fi network with deauthentication frames, causing them to disconnect from the network. These frames appear to come from the access point, exploiting weaknesses in the Wi-Fi protocol to disrupt connectivity without requiring authentication. While not directly compromising security, deauthentication attacks disrupt network access, potentially leading to denial-of-service conditions and facilitating other attacks like man-in-the-middle.
How to Defend: Defenses against deauthentication attacks include implementing intrusion detection and prevention systems, deploying wireless intrusion prevention systems, using strong encryption protocols like WPA2 or WPA3, enabling network segmentation, and monitoring for abnormal network activity. Additionally, users should exercise caution when connecting to public Wi-Fi networks and consider using virtual private networks (VPNs) for secure communication over untrusted networks.
wireless disassociation attack
A wireless disassociation attack disrupts Wi-Fi connectivity by flooding devices with disassociation frames, causing them to repeatedly disconnect from the network. Attackers exploit weaknesses in the Wi-Fi protocol to send these frames without authentication.
How to Defend: To defend against such attacks, network administrators can deploy intrusion detection and prevention systems, implement strong encryption protocols like WPA2 or WPA3, and monitor for abnormal network activity. Users should exercise caution when connecting to public Wi-Fi networks and consider using virtual private networks (VPNs) for secure communication over untrusted networks.
wireless jamming
Wireless jamming is a type of cyberattack aimed at disrupting wireless communications by flooding the airwaves with interference signals. In a jamming attack, the attacker transmits high-power radio frequency signals on the same frequencies used by the target wireless devices, such as Wi-Fi networks, Bluetooth devices, or cellular networks. This flood of interference disrupts the communication between devices and access points, causing connectivity issues, packet loss, and degraded performance. Wireless jamming attacks can be launched using specialized equipment or software-defined radio (SDR) devices and can be targeted at specific frequencies or broader spectrum ranges.
How to Defend: Defending against wireless jamming attacks requires implementing techniques such as frequency hopping, spread spectrum modulation, and adaptive power control to mitigate the impact of interference and maintain reliable wireless communication. Additionally, deploying intrusion detection and prevention systems (IDPS) and monitoring for abnormal radio frequency activity can help detect and mitigate jamming attacks in real-time.
spoofing
Spoofing is a cyberattack where an attacker falsifies data to impersonate another user, device, or system. They might fake IP addresses, email addresses, or other identifiers to deceive targets.
How to Defend: Defenses include authentication measures like digital signatures and two-factor authentication, as well as deploying intrusion detection systems to detect and block suspicious activity. Users should be cautious when interacting with unsolicited emails or messages and verify communication before responding.
RFID
RFID, or Radio Frequency Identification, is a technology that uses radio waves to wirelessly identify and track objects. It consists of small tags or labels containing electronic chips that store unique identification data and antennas to transmit and receive radio signals. RFID tags can be attached to various items, such as products in retail stores, library books, or assets in warehouses, enabling automated identification and tracking without the need for direct line-of-sight or manual scanning.
RFID is vulnerable to:
Spoofing: where attackers can impersonate legitimate RFID tags.
Eavesdropping: unauthorized parties can intercept and capture RFID communications.
Data interception: attackers can capture and steal data transmitted between RFID tags and readers.
Replay attacks: attackers can record and replay RFID communications to gain unauthorized access.
Denial-of-Service (DoS) attacks: attackers can disrupt RFID systems by flooding them with excessive requests or interference.
So, the correct answer is: All of the above.
NFC, or Near Field Communication, shares similarities with RFID and is also vulnerable to similar attacks:
Data interception: unauthorized parties can intercept and capture NFC communications, potentially accessing sensitive information.
Replay attacks: attackers can record and replay NFC transmissions to gain unauthorized access or perform fraudulent transactions.
Denial-of-Service (DoS) attacks: attackers can disrupt NFC systems by flooding them with excessive requests or interference, rendering them unavailable for legitimate use.
Therefore, the correct answer is: All of the above.
on path attack
An “on-path attack” occurs when an attacker inserts themselves into the network path between two communicating parties to intercept and alter data. Unlike traditional man-in-the-middle attacks where the attacker simply relays messages, in an on-path attack, the attacker actively modifies the transmitted data. By compromising network devices or exploiting vulnerabilities, the attacker gains access to the network path, allowing them to intercept, modify, or inject malicious content into the communication stream.
How to Defend: Defending against on-path attacks requires robust network security measures such as encryption, authentication, and intrusion detection systems to detect and mitigate suspicious activity. Additionally, regular security assessments and employee training are crucial for maintaining a secure network environment and preventing on-path attacks from succeeding.
ARP Poisoning
Difference between this and MAC cloning?
ARP poisoning, also known as ARP spoofing, is a cyberattack where an attacker manipulates the Address Resolution Protocol (ARP) to associate their MAC address with the IP address of a legitimate network device. By sending falsified ARP messages across a local area network (LAN), the attacker tricks other devices into believing that their machine is the legitimate destination for network traffic intended for the targeted device. Once the ARP cache of the victim device is poisoned, all traffic meant for it is rerouted to the attacker’s machine, allowing the attacker to intercept, modify, or even block data packets.
Defending against ARP poisoning requires implementing measures such as ARP spoofing detection mechanisms, network segmentation, and the use of encryption protocols like HTTPS and VPNs to protect data from interception or tampering by attackers. Regular security audits and employee training on recognizing and mitigating ARP poisoning attacks are also essential for maintaining a secure network environment.
Difference between this and MAC cloning? ARP poisoning is typically more temporary compared to MAC cloning. ARP poisoning relies on sending falsified ARP messages to manipulate the ARP cache entries of devices on the local area network (LAN). These ARP cache entries are used by devices to map IP addresses to MAC addresses for communication within the network.
MAC cloning involves permanently changing the MAC address of a network interface to match the MAC address of another device. This change persists even after network reboots or ARP cache updates.
DNS Poisoning
DNS poisoning, also known as DNS spoofing or DNS cache poisoning, is a cyberattack where an attacker corrupts the data in a Domain Name System (DNS) resolver’s cache. The DNS resolver is responsible for translating domain names (e.g., www.example.com) into IP addresses (e.g., 192.0.2.1) to facilitate communication between devices on the internet. In a DNS poisoning attack, the attacker injects false information into the DNS resolver’s cache, causing it to return incorrect IP addresses for legitimate domain names.
This manipulation can redirect users to malicious websites controlled by the attacker, leading to various security risks such as phishing, malware distribution, or theft of sensitive information. DNS poisoning attacks can be particularly harmful because they can affect a wide range of users who rely on the compromised DNS resolver for domain name resolution.
How to Defend: Defending against DNS poisoning requires implementing measures such as DNSSEC (Domain Name System Security Extensions), which adds cryptographic authentication to DNS responses to prevent tampering. Additionally, regularly monitoring DNS traffic, updating DNS software, and using reputable DNS resolvers can help mitigate the risk of DNS poisoning attacks.
