8: 7 Network Attacks Flashcards
DoS Attack
Denial of Service attack makes a system unavailable for legit users by sending a huge number of requests to a server.
Dos Limitations
Easy to block based on IP address, require a huge bandwidth
DDoS attacks
Utilizes botnets to overwhelm a target
Smurf attack
Attacker sends echo requests to third-party servers with a forged victim IP address, and then send reply to the victim’s IP address
Amplified DDoS attacks
Sends small requests that lead to large replies- looking for the higher amplification factor
Eavesdropping Attacks
Theft of information as a user communicates with a server over the web. Relies on compromised Communication path (network device tapping, DNS poisoning, ARP poisoning)
Man-in-the-middle Attack
Attacker tricks the user to establish a communication channel with the attacker, who then communicates with the server on behalf of the client while reading the information.
Replay Attack
Uses previously captured data to create a separate attack at a later date - just has the encoded version of the credentials
Defeat replay attacks
Use a token session system, and timestamps
SSL Stripping
Tricks browser into using unencrypted communications
DNS
Domain Name System, translates common domain names into IP address for the purpose of network routing
Hierarchical DNS lookup
Root Nameserver, then .org nameserver, then specific .org nameserver
DNS Poisoning
Inserting incorrect DNS records in a valid DNS Server than will then redirect the user to the attacker’s server.
Typosquatting
Registering many domain names with similar address hoping to capture legitimate traffic.
Domain Hijacking
Taking over control of an organization’s valid domain name.
URL Redirection
Attacker places redirects on a trusted site to content hosted on a malicious site.
ARP
Address Resolution Protocol - protocol that translates IP address to hardware MAC addresses on local area networks
ARP poisoning
Only works on LAN - Confuses system that the gateway device is different than expected.
MAC flooding attack
Rapidly cycle addresses on a single system to overwhelm the table that maintains MAC addresses in memory, causing switch to forget where system is located, which will then broadcast traffic
MAC Spoofing/Cloning
Alterns the assigned hardware address of a system to assume a false identity or engage in a MAC flooding attack
IP Spoofing
Alters the IP address of a system and normally can’t be used for two-way communication - difficult to reconfigure network to receive return traffic at a spoofed IP address.
Anti-Spoofing controls
Ingress Filtering - blocks inbound traffic that contains spoofed source addresses
Egress filtering - blocks outbound traffic that contains spoofed source addresses
Wireless Attacks on WEP
Attackers get enough Initialization vectors to reconstruct the encryption key
Wireless Attacks on WPA
WPA depends on RC4, but also TKIP (changing keys each time). Issue is with hashing function.
