Threats - Common Network Attacks

There are some attacks that can happen on your network. Here are a few common ones that could occur, and a lot of different ways that an attacker might attack a network.

Denial of service

A denial of service attack is when an attacker is attempting to make a service or a resource unavailable to legitimate users. This can come in a lot of different forms, but one example is when an attacker tries to overwhelm that resource. An example of this might be when this computer right here is trying to overwhelm this set of servers right here. Let's say this is a web server. This attacker is going to send a lot of requests to this server — maybe it's ping requests, maybe it's requests for websites, maybe it's requests to open up a TCP connection. Whatever it is, it's going to send a lot of them over here, overwhelming this machine, so that it can't serve up content to legitimate sources.

One thing that's interesting about this is that it can be fairly easy to execute but difficult to stop this type of attack from happening. One reason is because you have to identify traffic from an attacking source and stop it from happening, but you run the risk of stopping legitimate requests as well.

A Wi-Fi deauthentication attack is an example of a denial of service attack. If there's a wireless client that has access to a wireless network, then right at the end of when this client is done communicating, it will send a deauthentication message letting this wireless access point or wireless router know that it can disconnect this device from the network, and then it would shut down this connection. What can happen is that an attacker could send this deauthentication message to this wireless access point and let it know that yes, I am this machine right here and I want to disconnect. Essentially it's mimicking the message that this machine would send, and then this access point would say okay, I will disconnect you, and now this client no longer is authenticated on that network.

Jamming is another example of a denial of service attack. What it does is stop communication from happening through the airwaves, through wavelengths. Let's say this is a Wi-Fi connection right here, and then this computer, or maybe it's a device, sends out a similar frequency to what these two machines are talking on, that's stronger, that overwhelms the airwaves so that these two machines can't talk back and forth. This type of attack can be carried out across cellular phones, GPS, Wi-Fi, Bluetooth or any other wireless signals.

A DDoS attack is a type of denial of service attack: a distributed denial of service attack. The idea behind this is that you have multiple machines that are launching the attack to overwhelm some sort of service or resource. In this example right here, let's say we have a web server, and it's not just one machine but many machines launching a flood of information or a flood of requests — whether it's amp requests or TCP requests or some sort of webpage request or whatever it is — flooding this server with requests so it can't send out legitimate traffic. This is especially hard to combat against because all of these machines are coming from different sources, so it's hard to identify what is the culprit, what is the machine that you need to cut access to, and whether you are cutting access from legitimate sources.

Trust exploits

A trust exploit is when a machine exploits a trust. What does that look like? Let's say we have a machine right here that's able to get onto this bank of web servers and be able to program it or set it up or do some sort of configuration on it, so it is trusted with these web servers. But it doesn't allow an attacker to gain access to this resource right here; it blocks that type of communication. If this attacker right here gains access to this machine right here, then through this machine it now has access to this bank of web servers. So it's exploiting the trust connection that these two machines have and going through that to access an area that it's not supposed to have access to.

Snooping, sniffing and eavesdropping

Snooping is when someone gains access to data that they're not supposed to have access to.

Network sniffers are when you are actually listening to traffic across the network. An example: let's say there's a network across here and communication is going back and forth. If this machine is listening in to that conversation and looking at the packets that are going back and forth, then that is a network sniffer. It is looking at the packets. One thing that's important about this is that this is not necessarily an attack. This could be good intent or bad intent. I've gone on to the networks that I've managed before and sniffed out these packets to see what was happening on the network and see if we had any kind of issues on the network, or to troubleshoot an issue that's on the network. One program that can actually help us do that is Wireshark, which is a really cool program to be able to dig in and see what's happening on your network.

Eavesdropping is when you listen in to a secret conversation. It could be just that you're listening in with your ear at the door to a conversation that you're not supposed to be listening to, or it could be on your networks, using something like a packet or network sniffer to be able to listen to that traffic. That can also lead to snooping, where you actually gain access to data that you're not supposed to have.

Wiretapping is a form of eavesdropping. Specifically, it's about unauthorized monitoring and intercepting of electronic communication, where eavesdropping can be a little more general than that. This is specifically around electronic communication.

Eavesdropping can also lead to replay attacks. A replay attack is when some device replays a certain part of the communication to do something like gain access to another system or create some sort of delay. Let me give you an example. Let's say this machine is authenticating with this machine right here, and this machine is listening in to that conversation — the attacking machine is listening in to the conversation. During this exchange the password gets sent to authenticate with the server, but it gets sent encrypted. So this attacking machine doesn't actually know what the password is, but it can replay that password in its encrypted form to get access to this machine right here. So if it's not the proper authentication protocols that you're using, this machine can do a replay attack to gain access to this server over here.

On-path attacks

An on-path attack is when a machine or an attacker sits in between two devices that are communicating. It's different than a packet sniffer or a network sniffer. In this case right here we have a machine, and it's not just listening to the conversation going back and forth between these two devices; instead, the communication is actually being sent through this device right here — hence the name man in the middle, or on path. Man in the middle is another term for this.

The advantage of this is that now this machine can do things like eavesdrop and listen to the conversation, create a delay between these two devices, or perhaps send the wrong information to one or both of these devices. There are many reasons why this would be carried out, but this is the on-path or man-in-the-middle attack.

Spoofing

Spoofing is when you pretend to be somebody or something else, so a spoofing attack is just an imitation attack. What you're doing is imitating another machine. You're imitating an IP address, you're imitating a MAC address, you're imitating a DHCP server, an access point, a DNS server. There are many ways that you can actually spoof on networks nowadays, and it just means that you're pretending to be somebody else. An example of this is maybe this machine is talking to this server right here, and then this machine steps in, and there are ways that this machine can pretend to be this one right here, or spoof this machine right there. There are, once again, a lot of different ways that this actually could go about, even things like email spoofing, when somebody is pretending to be somebody else on email.

Evil twin is a type of spoofing attack. Let's say this machine wanted to spoof this access point right here. What it could do is start sending out messages pretending to be this access point. What happens then is that this machine right here connects to this attacking machine rather than the proper access point. So evil twin is when the attacker spoofs a wireless access point.

Compromised keys and session jacking

Encryption is great because two machines can talk back and forth without other devices seeing it, unless there's a compromised key. If there's a compromised key attack, so this machine somehow gains access to the key that's used to encrypt this data back and forth, then any of the traffic that goes back and forth, this machine would be able to decrypt and see what that communication actually happening between those two different devices is.

Session jacking is when an attacker takes over a session. If this machine sets up a session or a connection with this web server right here, it could use a token to maintain that communication back and forth. If this token is compromised, then this attacker can actually take over that session and gain unauthorized access to data or whatever is on this web server.

Injection attacks

An injection attack is when an attacker will inject some sort of malicious input into an application to create some sort of unintended function to be able to leverage the system. What this looks like — and we'll give a couple of examples in a second — is let's say this is a web application that's running right here. There's a database on the back end and there is some sort of userface on the machine, and maybe it's asking for some sort of information, and you input information in the form of some sort of code or script or something that's not intended. Maybe it's asking for a username, but you've put in some sort of script in there that gets sent now as an input into this web server. Then this web server maybe divulges some information, or you change information on this back-end database.

One example of an injection attack would be a SQL injection. Here we have a web server right here and we have a database server right here. The communication that happens between these is that these web servers request information and change information on the database server. So if a user requests information from these web servers, these web servers may go grab some information and then send it to this machine right here, or perhaps there's some data entry that happens and so it modifies this database. The communication between this web server and this database server is a SQL language. SQL stands for structured query language, and it's a language where you send these queries to the database to get information and retrieve information. What can happen is that if there is a user prompt right here, a user can put in this SQL language instead of something like a username, and it would send it to the web server. The web server treats it as if it's just simple data, a username, and sends it to the database, and that tricks the database into executing that SQL code or that SQL language.

XSS is actually pronounced cross-site scripting; cross-site scripting is what that stands for. Cross-site scripting is a type of injection. It's similar to a SQL injection, but in this case right here it's injecting a script. You inject script into an input that gets sent over to the web server and then compromises this web server. Then this is going to be sent out to other users, and then the other users are going to have this script play on their machines, compromising those machines.

Side channel attacks

Probably one of the more bizarre types of attacks is a side channel attack. Most of the other attacks that we talked about are direct attacks, that is, they leverage some sort of vulnerability directly with the software that they're trying to attack, or some sort of communication with a protocol that they're trying to use. But a side channel attack is a little strange in the way it operates. It's a little bit of an indirect attack.

There are things that happen on our computers and with the equipment that we have that let off signals, that let off some sort of variation in the way that it operates. One of those examples might be that there is some sort of electromagnetic interference that it's sending out — EMI, or EMF, electromagnetic frequency, it's sending this out. And I don't mean something like wireless, just that things that are electronic emit signals. Same thing with maybe the way it's accessing a drive or the way it's accessing some sort of information: there are certain vibrations that will happen to that machine, there are certain power fluctuations, there are certain timing differences in how it communicates, maybe how it sends data and receives data. There are certain timing changes that give hints to what's happening on that machine.

So maybe if I send certain data to, let's say, a Windows machine, it's going to respond with certain timing differences than, let's say, a Linux machine. They're going to let off certain frequencies that are going to be different, certain vibrations are going to be different, certain power consumption is going to be different. So even though it's the same physical hardware, there are going to be variations in how it's operating depending on what it's processing and what it's doing.

We've started figuring out how to analyze those EMFs, the vibrations, the power consumption, the timing — to start to analyze that to figure out what's happening on the machine and use that to hack. So it's a real strange way to approach this hacking, but it's one of those things that we do need to watch out for, because it's a vulnerability of machines and how they operate.

There are a lot of different types of attacks, and this is not the full list. These are just some common ones that are out there that you need to watch out for. New vulnerabilities are found every day, and so new attacks are evolving and changing, and we constantly have to be vigilant about finding new ways to combat these types of attacks. It's important to keep these in mind so we know the steps that we need to take to keep our network secure.