SlideShare a Scribd company logo
Chapter 4 Network Vulnerabilities and Attacks
Cyberwar and Cyberterrorism "Titan Rain" - Attacks on US gov't and military computers from China breached hundreds of systems in 2005 (link Ch 4a) In 2007, Estonia was attacked by Russian computers as a political statement Using DDoS (Distributed Denial of Service) with botnets (Ch 4b)
Objectives Explain the types of network vulnerabilities List categories of network attacks Define different methods of network attacks
 
Media-Based Vulnerabilities Monitoring network traffic Helps to identify and troubleshoot network problems Monitoring traffic can be done in two ways Use a switch with  port mirroring Copies all traffic to a designated monitoring port on the switch Install a  network tap (test access point) A device that installed between two network devices, such as a switch, router, or firewall, to monitor traffic
Port Mirroring
Sniffer
Network Tap
Sniffing Attacks Just as network taps and protocol analyzers can be used for legitimate purposes They also can be used by attackers to intercept and view network traffic Attackers can access the wired network in the following ways: False ceilings Exposed wiring Unprotected RJ-45 jacks
Ways to Redirect Switched Traffic
Network Device Vulnerabilities Passwords Passwords should be long and complex Should be changed frequently Should not be written down But that is a difficult task  Solution: Password Manager Software (link Ch 4d)
Characteristics of Weak Passwords A common word used as a password Not changing passwords unless forced to do so Passwords that are short Personal information in a password Using the same password for all accounts Writing the password down
Network Device Vulnerabilities Default account A user account on a device that is created automatically by the device instead of by an administrator Used to make the initial setup and installation of the device (often by outside personnel) easier Although default accounts are intended to be deleted after the installation is completed, often they are not Default accounts are often the first targets that attackers seek
ATM Passwords In 2008, these men used default passwords to reprogram ATM machines to hand out $20 bills like they were $1 bills Link Ch 4e
Network Device Vulnerabilities Back door An account that is secretly set up without the administrator’s knowledge or permission, that cannot be easily detected, and that allows for remote access to the device Back doors can be created: By a virus, worm, or Trojan horse By a programmer of the software on the device Built into the hardware chips
Hardware Trojans Military equipment contains chips from foreign countries Those chips can contain backdoors or kill switches Link Ch 4e
Network Device Vulnerabilities Privilege escalation Changing a limited user to an Administrator Link Ch 4g
 
Denial of Service (DoS) Attempts to consume network resources so that the network or its devices cannot respond to legitimate requests Example: SYN flood attack See Figure 4-4 Distributed denial of service (DDoS)  attack A variant of the DoS May use hundreds or thousands of zombie computers in a botnet to flood a device with requests
 
Real DDoS Attack Link Ch 4i
Wireless DoS Requires a powerful transmitter
An Easier Wireless DoS
Spoofing Spoofing  is impersonation Attacker pretends to be someone else Malicious actions would be attributed to another user Spoof the network address of a known and trusted host Spoof a wireless router to intercept traffic
Man-in-the-Middle Attack Passive --attacker reads traffic Active --attacker changes traffic Common on networks
Replay Attack Attacker captures data Resends the same data later A simple attack: capture passwords and save them
Wall of Sheep Captured passwords projected on the wall at DEFCON Link Ch 4j
Sidejacking Records cookies and replays them (link Ch 4k) This technique breaks into Gmail accounts Technical name: Cross Site Request Forgery Almost all social networking sites are vulnerable to this attack Facebook, MySpace, Yahoo, etc.
 
SNMP (Simple Network Management Protocol) Used to manage switches, routers, and other network devices Early versions did not encrypt passwords, and had other security flaws But the old versions are still commonly used
DNS (Domain Name System) DNS is used to resolve domain names like  www.ccsf.edu  to IP addresses like  147.144.1.254 DNS has many vulnerabilities It was never designed to be secure Where is  www.ccsf.edu ? www.ccsf.edu  is at  147.144.1.254
DNS Poisoning
Local DNS Poisoning Put false entries into the Hosts file C:\Windows\System32\Drivers\etc\hosts
DNS Cache Poisoning Attacker sends many spoofed DNS responses Target just accepts the first one it gets Where is  www.ccsf.edu ? www.ccsf.edu  is at  147.144.1.254 www.ccsf.edu  is at  63.145.23.12
Sending Extra DNS Records
DNS Transfers Intended to let a new DNS server copy the records from an existing one Can be used by attackers to get a list of all the machines in a company, like a network diagram Usually blocked by modern DNS servers
Protection from DNS Attacks Antispyware software will warn you when the hosts file is modified Using updated versions of DNS server software prevents older DNS attacks against the server But many DNS flaws cannot be patched Eventually: Switch to DNSSEC (Domain Name System Security Extensions) But DNSSEC is not widely deployed yet, and it has its own problems Link Ch 4l
ARP (Address Resolution Protocol) ARP is used to convert IP addresses like  147.144.1.254  into MAC addresses like  00-30-48-82-11-34 Where is  147.144.1.254 ? 147.144.1.254  is at  00-30-48-82-11-34
ARP Cache Poisoning Attacker sends many spoofed ARP responses Target just accepts the first one it gets Where is  147.144.1.254 ? 147.144.1.254  is at  00-30-48-82-11-34 147.144.1.254  is at  00-00-00-4A-AB-07
Results of ARP Poisoning Attacks
TCP/IP Hijacking Takes advantage of a weakness in the TCP/IP protocol The TCP header contains of two 32-bit fields that are used as packet counters Sequence  and  Acknowledgement  numbers Packets may arrive out of order Receiver uses the Sequence numbers to put the packets back in order
 
Wireless Attacks Rogue access points Employees often set up home wireless routers for convenience at work This allows attackers to bypass all of the network security and opens the entire network and all users to direct attacks An attacker who can access the network through a rogue access point is behind the company's firewall Can directly attack all devices on the network
 
Wireless Attacks (continued) War driving Beaconing At regular intervals, a wireless AP sends a beacon frame to announce its presence and to provide the necessary information for devices that want to join the network Scanning Each wireless device looks for those beacon frames Unapproved wireless devices can likewise pick up the beaconing RF transmission Formally known as  wireless location mapping
Wireless Attacks (continued) War driving (continued) War driving technically involves using an automobile to search for wireless signals over a large area Tools for conducting war driving: Mobile computing device Wireless NIC adapters Antennas Global positioning system receiver Software
Wireless Attacks (continued) Bluetooth A wireless technology that uses short-range RF transmissions Provides for rapid “on the fly” and ad hoc connections between devices Bluesnarfing Stealing data through a Bluetooth connection E-mails, calendars, contact lists, and cell phone pictures and videos, …
 
Null Sessions Connections to a Microsoft Windows 2000 or Windows NT computer with a blank username and password Attacker can collect a lot of data from a vulnerable system Cannot be fixed by patches to the operating systems Much less of a problem with modern Windows versions, Win XP SP2, Vista, or Windows 7
Domain Name Kiting Check kiting A type of fraud that involves the unlawful use of checking accounts to gain additional time before the fraud is detected Domain Name Kiting Registrars are organizations that are approved by ICANN to sell and register Internet domain names A five-day Add Grade Period (AGP) permits registrars to delete any newly registered Internet domain names and receive a full refund of the registration fee
Domain Name Kiting Unscrupulous registrars register thousands of Internet domain names and then delete them  Recently expired domain names are indexed by search engines Visitors are directed to a re-registered site Which is usually a single page Web with paid advertisement links Visitors who click on these links generate money for the registrar

More Related Content

PPTX
Different types of attacks in internet
PPTX
NETWORK PENETRATION TESTING
PPT
Cyber security for an organization
PDF
Anatomy of a cyber attack
PPTX
Network scanning
PPT
Penetration Testing Basics
PPTX
Cybersecurity
Different types of attacks in internet
NETWORK PENETRATION TESTING
Cyber security for an organization
Anatomy of a cyber attack
Network scanning
Penetration Testing Basics
Cybersecurity

What's hot (20)

PPTX
Security Threats at OSI layers
PDF
Secure by Design - Security Design Principles for the Rest of Us
PPTX
Introduction to penetration testing
PDF
Penetration Testing Tutorial | Penetration Testing Tools | Cyber Security Tra...
PDF
Web Application Penetration Testing
PDF
Breach and attack simulation tools
PPTX
Introduction to Incident Response Management
PPT
Web security
PPTX
Web application security
PPTX
Intrusion detection system
PPTX
Vulnerability assessment and penetration testing
PPTX
Penetration testing reporting and methodology
PPTX
Risk assessment
PDF
Threat hunting 101 by Sandeep Singh
PPTX
Vulnerability Assessment
PPT
Web Application Security
PDF
How MITRE ATT&CK helps security operations
PPTX
Logging, monitoring and auditing
PDF
Ch 11: Hacking Wireless Networks
PPTX
SQL injection
Security Threats at OSI layers
Secure by Design - Security Design Principles for the Rest of Us
Introduction to penetration testing
Penetration Testing Tutorial | Penetration Testing Tools | Cyber Security Tra...
Web Application Penetration Testing
Breach and attack simulation tools
Introduction to Incident Response Management
Web security
Web application security
Intrusion detection system
Vulnerability assessment and penetration testing
Penetration testing reporting and methodology
Risk assessment
Threat hunting 101 by Sandeep Singh
Vulnerability Assessment
Web Application Security
How MITRE ATT&CK helps security operations
Logging, monitoring and auditing
Ch 11: Hacking Wireless Networks
SQL injection
Ad

Viewers also liked (20)

PPT
Microsoft Operating System Vulnerabilities
PPT
Ch03 Protecting Systems
PPT
Ch10 Conducting Audits
PPT
Ch09 Performing Vulnerability Assessments
PPT
Ch13 Business Continuity Planning and Procedures
PPT
Ch05 Network Defenses
PPT
Ch01 Introduction to Security
PPT
Ch14 Policies and Legislation
PPT
Ch02 System Threats and Risks
PPT
Ch12 Cryptographic Protocols and Public Key Infrastructure
PPT
Ch08 Authentication
PPT
Ch11 Basic Cryptography
PPT
Ch06 Wireless Network Security
PPT
PPT
Ch07 Access Control Fundamentals
PPTX
PACE-IT, Security+3.4: Summary of Wireless Attacks
PDF
Cc code cards
PDF
OSCON 2008: Porting to Python 3.0
PPTX
Introduction to Graphics
Microsoft Operating System Vulnerabilities
Ch03 Protecting Systems
Ch10 Conducting Audits
Ch09 Performing Vulnerability Assessments
Ch13 Business Continuity Planning and Procedures
Ch05 Network Defenses
Ch01 Introduction to Security
Ch14 Policies and Legislation
Ch02 System Threats and Risks
Ch12 Cryptographic Protocols and Public Key Infrastructure
Ch08 Authentication
Ch11 Basic Cryptography
Ch06 Wireless Network Security
Ch07 Access Control Fundamentals
PACE-IT, Security+3.4: Summary of Wireless Attacks
Cc code cards
OSCON 2008: Porting to Python 3.0
Introduction to Graphics
Ad

Similar to Ch04 Network Vulnerabilities and Attacks (20)

PPT
Hacking
PPTX
Lec 2- Hardening and whitelisting of devices
PPT
Lec21 security
PPTX
Attacks and Malicious Software - Information security
PPT
Network security
PPT
Lec21 security
PPT
Lec21 security
PPT
Network seurity
PDF
Network Security & Attacks
PPT
Network security
PPT
Threats to network
PPT
Introduction To Information Security
PPT
Network Security R U Secure???
PPTX
UNIT 5 (2).pptx
PPT
Hacking Cisco
PPTX
NIS1ppt (1).pptxhgfchgfhgfhgfgjdgfdhgdhgfehft
PPT
Network security
PPTX
Lesson 3 - Network Security.pptx
PPT
EC3401 Networks security PRAVEEN KUMAR K
PPT
Network Security Attacks, and Solutions.
Hacking
Lec 2- Hardening and whitelisting of devices
Lec21 security
Attacks and Malicious Software - Information security
Network security
Lec21 security
Lec21 security
Network seurity
Network Security & Attacks
Network security
Threats to network
Introduction To Information Security
Network Security R U Secure???
UNIT 5 (2).pptx
Hacking Cisco
NIS1ppt (1).pptxhgfchgfhgfhgfgjdgfdhgdhgfehft
Network security
Lesson 3 - Network Security.pptx
EC3401 Networks security PRAVEEN KUMAR K
Network Security Attacks, and Solutions.

More from Information Technology (20)

PDF
Sql Server Security Best Practices
PPT
PPT
SQL 2005 Disk IO Performance
PPT
PPT
Review of SQL
PPT
Sql 2005 high availability
PPT
IIS 7: The Administrator’s Guide
PPT
MOSS 2007 Deployment Fundamentals -Part2
PPT
MOSS 2007 Deployment Fundamentals -Part1
PPT
Clustering and High Availability
PDF
F5 beyond load balancer (nov 2009)
PPT
WSS 3.0 & SharePoint 2007
PPT
SharePoint Topology
PDF
Sharepoint Deployments
PPT
Microsoft Clustering
PDF
Scalable Internet Servers and Load Balancing
PPT
Migration from ASP to ASP.NET
PPT
Internet Traffic Monitoring and Analysis
PPT
Windows network security
Sql Server Security Best Practices
SQL 2005 Disk IO Performance
Review of SQL
Sql 2005 high availability
IIS 7: The Administrator’s Guide
MOSS 2007 Deployment Fundamentals -Part2
MOSS 2007 Deployment Fundamentals -Part1
Clustering and High Availability
F5 beyond load balancer (nov 2009)
WSS 3.0 & SharePoint 2007
SharePoint Topology
Sharepoint Deployments
Microsoft Clustering
Scalable Internet Servers and Load Balancing
Migration from ASP to ASP.NET
Internet Traffic Monitoring and Analysis
Windows network security

Recently uploaded (20)

PDF
RMMM.pdf make it easy to upload and study
PDF
Anesthesia in Laparoscopic Surgery in India
PDF
Mark Klimek Lecture Notes_240423 revision books _173037.pdf
PDF
grade 11-chemistry_fetena_net_5883.pdf teacher guide for all student
PPTX
Introduction to Child Health Nursing – Unit I | Child Health Nursing I | B.Sc...
PDF
Complications of Minimal Access Surgery at WLH
PDF
Origin of periodic table-Mendeleev’s Periodic-Modern Periodic table
PPTX
Week 4 Term 3 Study Techniques revisited.pptx
PDF
Saundersa Comprehensive Review for the NCLEX-RN Examination.pdf
PPTX
Cell Types and Its function , kingdom of life
PDF
Supply Chain Operations Speaking Notes -ICLT Program
PDF
Chapter 2 Heredity, Prenatal Development, and Birth.pdf
PPTX
school management -TNTEU- B.Ed., Semester II Unit 1.pptx
PDF
Physiotherapy_for_Respiratory_and_Cardiac_Problems WEBBER.pdf
PDF
3rd Neelam Sanjeevareddy Memorial Lecture.pdf
PDF
Module 4: Burden of Disease Tutorial Slides S2 2025
PDF
01-Introduction-to-Information-Management.pdf
PPTX
The Healthy Child – Unit II | Child Health Nursing I | B.Sc Nursing 5th Semester
PDF
BÀI TẬP BỔ TRỢ 4 KỸ NĂNG TIẾNG ANH 9 GLOBAL SUCCESS - CẢ NĂM - BÁM SÁT FORM Đ...
PPTX
PPT- ENG7_QUARTER1_LESSON1_WEEK1. IMAGERY -DESCRIPTIONS pptx.pptx
RMMM.pdf make it easy to upload and study
Anesthesia in Laparoscopic Surgery in India
Mark Klimek Lecture Notes_240423 revision books _173037.pdf
grade 11-chemistry_fetena_net_5883.pdf teacher guide for all student
Introduction to Child Health Nursing – Unit I | Child Health Nursing I | B.Sc...
Complications of Minimal Access Surgery at WLH
Origin of periodic table-Mendeleev’s Periodic-Modern Periodic table
Week 4 Term 3 Study Techniques revisited.pptx
Saundersa Comprehensive Review for the NCLEX-RN Examination.pdf
Cell Types and Its function , kingdom of life
Supply Chain Operations Speaking Notes -ICLT Program
Chapter 2 Heredity, Prenatal Development, and Birth.pdf
school management -TNTEU- B.Ed., Semester II Unit 1.pptx
Physiotherapy_for_Respiratory_and_Cardiac_Problems WEBBER.pdf
3rd Neelam Sanjeevareddy Memorial Lecture.pdf
Module 4: Burden of Disease Tutorial Slides S2 2025
01-Introduction-to-Information-Management.pdf
The Healthy Child – Unit II | Child Health Nursing I | B.Sc Nursing 5th Semester
BÀI TẬP BỔ TRỢ 4 KỸ NĂNG TIẾNG ANH 9 GLOBAL SUCCESS - CẢ NĂM - BÁM SÁT FORM Đ...
PPT- ENG7_QUARTER1_LESSON1_WEEK1. IMAGERY -DESCRIPTIONS pptx.pptx

Ch04 Network Vulnerabilities and Attacks

  • 1. Chapter 4 Network Vulnerabilities and Attacks
  • 2. Cyberwar and Cyberterrorism "Titan Rain" - Attacks on US gov't and military computers from China breached hundreds of systems in 2005 (link Ch 4a) In 2007, Estonia was attacked by Russian computers as a political statement Using DDoS (Distributed Denial of Service) with botnets (Ch 4b)
  • 3. Objectives Explain the types of network vulnerabilities List categories of network attacks Define different methods of network attacks
  • 4.  
  • 5. Media-Based Vulnerabilities Monitoring network traffic Helps to identify and troubleshoot network problems Monitoring traffic can be done in two ways Use a switch with port mirroring Copies all traffic to a designated monitoring port on the switch Install a network tap (test access point) A device that installed between two network devices, such as a switch, router, or firewall, to monitor traffic
  • 9. Sniffing Attacks Just as network taps and protocol analyzers can be used for legitimate purposes They also can be used by attackers to intercept and view network traffic Attackers can access the wired network in the following ways: False ceilings Exposed wiring Unprotected RJ-45 jacks
  • 10. Ways to Redirect Switched Traffic
  • 11. Network Device Vulnerabilities Passwords Passwords should be long and complex Should be changed frequently Should not be written down But that is a difficult task Solution: Password Manager Software (link Ch 4d)
  • 12. Characteristics of Weak Passwords A common word used as a password Not changing passwords unless forced to do so Passwords that are short Personal information in a password Using the same password for all accounts Writing the password down
  • 13. Network Device Vulnerabilities Default account A user account on a device that is created automatically by the device instead of by an administrator Used to make the initial setup and installation of the device (often by outside personnel) easier Although default accounts are intended to be deleted after the installation is completed, often they are not Default accounts are often the first targets that attackers seek
  • 14. ATM Passwords In 2008, these men used default passwords to reprogram ATM machines to hand out $20 bills like they were $1 bills Link Ch 4e
  • 15. Network Device Vulnerabilities Back door An account that is secretly set up without the administrator’s knowledge or permission, that cannot be easily detected, and that allows for remote access to the device Back doors can be created: By a virus, worm, or Trojan horse By a programmer of the software on the device Built into the hardware chips
  • 16. Hardware Trojans Military equipment contains chips from foreign countries Those chips can contain backdoors or kill switches Link Ch 4e
  • 17. Network Device Vulnerabilities Privilege escalation Changing a limited user to an Administrator Link Ch 4g
  • 18.  
  • 19. Denial of Service (DoS) Attempts to consume network resources so that the network or its devices cannot respond to legitimate requests Example: SYN flood attack See Figure 4-4 Distributed denial of service (DDoS) attack A variant of the DoS May use hundreds or thousands of zombie computers in a botnet to flood a device with requests
  • 20.  
  • 21. Real DDoS Attack Link Ch 4i
  • 22. Wireless DoS Requires a powerful transmitter
  • 24. Spoofing Spoofing is impersonation Attacker pretends to be someone else Malicious actions would be attributed to another user Spoof the network address of a known and trusted host Spoof a wireless router to intercept traffic
  • 25. Man-in-the-Middle Attack Passive --attacker reads traffic Active --attacker changes traffic Common on networks
  • 26. Replay Attack Attacker captures data Resends the same data later A simple attack: capture passwords and save them
  • 27. Wall of Sheep Captured passwords projected on the wall at DEFCON Link Ch 4j
  • 28. Sidejacking Records cookies and replays them (link Ch 4k) This technique breaks into Gmail accounts Technical name: Cross Site Request Forgery Almost all social networking sites are vulnerable to this attack Facebook, MySpace, Yahoo, etc.
  • 29.  
  • 30. SNMP (Simple Network Management Protocol) Used to manage switches, routers, and other network devices Early versions did not encrypt passwords, and had other security flaws But the old versions are still commonly used
  • 31. DNS (Domain Name System) DNS is used to resolve domain names like www.ccsf.edu to IP addresses like 147.144.1.254 DNS has many vulnerabilities It was never designed to be secure Where is www.ccsf.edu ? www.ccsf.edu is at 147.144.1.254
  • 33. Local DNS Poisoning Put false entries into the Hosts file C:\Windows\System32\Drivers\etc\hosts
  • 34. DNS Cache Poisoning Attacker sends many spoofed DNS responses Target just accepts the first one it gets Where is www.ccsf.edu ? www.ccsf.edu is at 147.144.1.254 www.ccsf.edu is at 63.145.23.12
  • 35. Sending Extra DNS Records
  • 36. DNS Transfers Intended to let a new DNS server copy the records from an existing one Can be used by attackers to get a list of all the machines in a company, like a network diagram Usually blocked by modern DNS servers
  • 37. Protection from DNS Attacks Antispyware software will warn you when the hosts file is modified Using updated versions of DNS server software prevents older DNS attacks against the server But many DNS flaws cannot be patched Eventually: Switch to DNSSEC (Domain Name System Security Extensions) But DNSSEC is not widely deployed yet, and it has its own problems Link Ch 4l
  • 38. ARP (Address Resolution Protocol) ARP is used to convert IP addresses like 147.144.1.254 into MAC addresses like 00-30-48-82-11-34 Where is 147.144.1.254 ? 147.144.1.254 is at 00-30-48-82-11-34
  • 39. ARP Cache Poisoning Attacker sends many spoofed ARP responses Target just accepts the first one it gets Where is 147.144.1.254 ? 147.144.1.254 is at 00-30-48-82-11-34 147.144.1.254 is at 00-00-00-4A-AB-07
  • 40. Results of ARP Poisoning Attacks
  • 41. TCP/IP Hijacking Takes advantage of a weakness in the TCP/IP protocol The TCP header contains of two 32-bit fields that are used as packet counters Sequence and Acknowledgement numbers Packets may arrive out of order Receiver uses the Sequence numbers to put the packets back in order
  • 42.  
  • 43. Wireless Attacks Rogue access points Employees often set up home wireless routers for convenience at work This allows attackers to bypass all of the network security and opens the entire network and all users to direct attacks An attacker who can access the network through a rogue access point is behind the company's firewall Can directly attack all devices on the network
  • 44.  
  • 45. Wireless Attacks (continued) War driving Beaconing At regular intervals, a wireless AP sends a beacon frame to announce its presence and to provide the necessary information for devices that want to join the network Scanning Each wireless device looks for those beacon frames Unapproved wireless devices can likewise pick up the beaconing RF transmission Formally known as wireless location mapping
  • 46. Wireless Attacks (continued) War driving (continued) War driving technically involves using an automobile to search for wireless signals over a large area Tools for conducting war driving: Mobile computing device Wireless NIC adapters Antennas Global positioning system receiver Software
  • 47. Wireless Attacks (continued) Bluetooth A wireless technology that uses short-range RF transmissions Provides for rapid “on the fly” and ad hoc connections between devices Bluesnarfing Stealing data through a Bluetooth connection E-mails, calendars, contact lists, and cell phone pictures and videos, …
  • 48.  
  • 49. Null Sessions Connections to a Microsoft Windows 2000 or Windows NT computer with a blank username and password Attacker can collect a lot of data from a vulnerable system Cannot be fixed by patches to the operating systems Much less of a problem with modern Windows versions, Win XP SP2, Vista, or Windows 7
  • 50. Domain Name Kiting Check kiting A type of fraud that involves the unlawful use of checking accounts to gain additional time before the fraud is detected Domain Name Kiting Registrars are organizations that are approved by ICANN to sell and register Internet domain names A five-day Add Grade Period (AGP) permits registrars to delete any newly registered Internet domain names and receive a full refund of the registration fee
  • 51. Domain Name Kiting Unscrupulous registrars register thousands of Internet domain names and then delete them Recently expired domain names are indexed by search engines Visitors are directed to a re-registered site Which is usually a single page Web with paid advertisement links Visitors who click on these links generate money for the registrar