Page 1

Network Security Systems Chapter 4 Network Vulnerabilities and Attacks KS Chua Lecture Singapore Polytechnic

Objectives  Explain the types of network vulnerabilities  List categories of network attacks  Define different methods of network attacks

2

1


Network Vulnerabilities (Pg 121)  There are two broad categories of network vulnerabilities:  

network transport media-based vulnerabilities network devices vulnerabilities

3

Network Vulnerabilities (continued)  Media-Based Vulnerabilities (pg 121) 

Monitoring network traffic 



Helps to identify and troubleshoot network problems Can be done in two ways: • Use a switch with port mirroring to redirect traffic that occurs on some or all ports to a designated monitoring port on the switch • Install a network tap (test access point) which is a separate device that can be installed between two network devices, such as a switch, router or firewall, to monitor traffic 4

2


Network Vulnerabilities (continued)  Media-Based Vulnerabilities (continued)

5

Network Vulnerabilities (continued)  Media-Based Vulnerabilities (continued)

6

3


Network Vulnerabilities (continued)  Media-Based Vulnerabilities (continued)

7

Network Vulnerabilities (continued)  Media-Based Vulnerabilities (continued) 

Just as network taps and protocol analyzers can be used for legitimate purposes 



They also can be used by attackers to intercept and view network traffic

Attackers can access the wired network in the following ways:   

False ceilings Exposed wiring Unprotected RJ-45 jacks 8

4


Network Vulnerabilities (continued)  Media-Based Vulnerabilities (continued)

9

Network Vulnerabilities (continued)  Network Device Vulnerabilities (Pg 123) 

Weak passwords 



A password is a secret combination of letters and numbers that serves to authenticate (validate) a user by what he knows Password paradox • Lengthy and complex passwords should be used and never written down • It is very difficult to memorize these types of passwords



Passwords can be set to expire after a set period of time, and a new one must be created 10

5


Network Vulnerabilities (continued)  Network Device Vulnerabilities (continued) 

Characteristics of weak passwords      

A common word used as a password Not changing passwords unless forced to do so Passwords that are short Personal information in a password Using the same password for all accounts Writing the password down

11

Network Vulnerabilities (continued)  Network Device Vulnerabilities (continued) 

Default account 







A user account on a device that is created automatically by the device instead of by an administrator Used to make the initial setup and installation of the device (often by outside personnel) easier Although default accounts are intended to be deleted after the installation is completed, often they are not Default accounts are often the first targets that attackers seek 12

6


Network Vulnerabilities (continued)  Network Device Vulnerabilities (continued)

13

Network Vulnerabilities (continued)  Network Device Vulnerabilities (continued) 

Back door 



An account that is secretly set up without the administrator’s knowledge or permission, that cannot be easily detected, and that allows for remote access to the device Back doors can be created on a network device in two ways • The network device can be infected by an attacker using a virus, worm, or Trojan horse • A programmer of the software creates a back door on the device 14

7


Network Vulnerabilities (continued)  Network Device Vulnerabilities (continued) 

Privilege escalation 

It is possible to exploit a vulnerability in the network device’s software to gain access to resources that the user would normally be restricted from obtaining

15

Categories of Attacks (Pg 126)  Categories include denial of service, spoofing, man-in-the-middle, and replay attacks

16

8


Categories of Attacks (continued)  Denial of Service (DoS) (pg 126) 

Denial of service (DoS) attack 



Attempts to consume network resources so that the network or its devices cannot respond to legitimate requests Example: SYN flood attack • See Figure 4-4



Distributed denial of service (DDoS) attack  

A variant of the DoS May use hundreds or thousands of zombie computers in a botnet to flood a device with requests

17

Categories of Attacks (continued)  Denial of Service (DoS) (continued)

18

9


Categories of Attacks (continued)  Denial of Service (DoS) (continued)

19

Categories of Attacks (continued)  Denial of Service (DoS) (continued)

20

10


Categories of Attacks (continued)  Denial of Service (DoS) (continued)

21

Categories of Attacks (continued)  Spoofing (pg 130) 

Spoofing is impersonation 



Pretends to be someone or something else by presenting false information

Variety of different attacks use spoofing 





Attacker may spoof her address so that her malicious actions would be attributed to a valid user Attacker may spoof his network address with an address of a known and trusted host Attacker can set up his AP device and trick all wireless devices to communicate with the imposter device 22

11


Categories of Attacks (continued)  Man-in-the-Middle (pg 130) 

Man-in-the-middle attack 

 

Intercepts legitimate communication and forges a fictitious response to the sender Common on networks Can be active or passive • Active attacks intercept and alter the contents before they are sent on to the recipient

23

Categories of Attacks (continued)  Man-in-the-Middle (continued)

24

12


Categories of Attacks (continued)  Replay (pg 131) 

Replay attack  





Similar to a passive man-in-the-middle attack Captured data is used at a later time

A simple replay would involve the man-in-the-middle capturing login credentials between the computer and the server A more sophisticated attack takes advantage of the communications between a device and a server 

Administrative messages that contain specific network requests are frequently sent between a network device and a server 25

Methods of Network Attacks (Pg 131)  Network attack methods can be   

protocol-based wireless As well as other methods

26

13


Methods of Network Attacks (continued)  Protocol-Based Attacks (pg 131) 

Antiquated protocols 



TCP/IP protocols have been updated often to address security vulnerabilities SNMP is another updated protocol • Used for exchanging management information between networked devices • The use of community strings in the first two versions of SNMP, SNMPv1 and SNMPv2, created several vulnerabilities • SNMPv3 was introduced in 1998 27

Methods of Network Attacks (continued)  Protocol-Based Attacks (continued) 

DNS attacks 



Domain Name System (DNS) is the basis for name resolution to IP addresses today DNS poisoning • Substitute a fraudulent IP address so that when a user enters a symbolic name, she is directed to the fraudulent computer site

28

14


Methods of Network Attacks (continued)  DNS Poisoning (continued)

29

Methods of Network Attacks (continued)  Protocol-Based Attacks (continued) 

DNS poisoning (continued) 

Substituting a fraudulent IP address can be done in one of two different locations • TCP/IP host table name system (See Figure 4-10) • External DNS server – Attack is called DNS poisoning (also called DNS spoofing) – See Figure 4-11



DNS poisoning can be prevented by using the latest editions of the DNS software, BIND (Berkeley Internet Name Domain) 30

15


Methods of Network Attacks (continued)  DNS Poisoning (continued)

31

Methods of Network Attacks (continued)  DNS Poisoning (continued)

32

16


Methods of Network Attacks (continued)  Protocol-Based Attacks (continued) 

DNS transfers  



Almost the reverse of DNS poisoning Attacker asks the valid DNS server for a zone transfer, known as a DNS transfer Possible for the attacker to map the entire internal network of the organization supporting the DNS server

33

Methods of Network Attacks (continued)  Protocol-Based Attacks (continued) 

ARP poisoning 

Address Resolution Protocol (ARP) • Used by TCP/IP on an Ethernet network to find the MAC address of another device • The IP address and the corresponding MAC address are stored in an ARP cache for future reference



An attacker could alter the MAC address in the ARP cache so that the corresponding IP address would point to a different computer

34

17


Methods of Network Attacks (continued) 

ARP poisoning (continued)

35

Methods of Network Attacks (continued)  Protocol-Based Attacks (continued) 

TCP/IP hijacking 



Takes advantage of a weakness in the TCP/IP protocol The TCP header consists of two 32-bit fields that are used as packet counters • Updated as packets are sent and received between devices



Packets may arrive out of order • Receiving device will drop any packets with lower sequence numbers 36

18


Methods of Network Attacks (continued)  Protocol-Based Attacks (continued) 

TCP/IP hijacking (continued) 



If both sender and receiver have incorrect sequence numbers, the connection will “hang” In a TCP/IP hijacking attack, the attacker creates fictitious (“spoofed”) TCP packets to take advantage of the weaknesses

37

Methods of Network Attacks (continued) 

TCP/IP hijacking (continued)

38

19


Methods of Network Attacks (continued)  Wireless Attacks (pg 137) 

Rogue access points 





Rogue means someone or something that is deceitful or unreliable Bypass all of the network security and opens the entire network and all users to direct attacks An attacker who can access the network through a rogue access point is behind the firewall • Can directly attack all devices on the network

39

Methods of Network Attacks (continued)  Wireless Attacks (continued)

40

20


Methods of Network Attacks (continued)  Wireless Attacks (continued) 

War driving 

Beaconing • At regular intervals, a wireless AP sends a beacon frame to announce its presence and to provide the necessary information for devices that want to join the network



Scanning • Each wireless device looks for those beacon frames





Unapproved wireless devices can likewise pick up the beaconing RF transmission Formally known as wireless location mapping 41

Methods of Network Attacks (continued)  Wireless Attacks (continued) 

War driving (continued) 



War driving technically involves using an automobile to search for wireless signals over a large area Tools for conducting war driving: • • • • •

Mobile computing device Wireless NIC adapters Antennas Global positioning system receiver Software 42

21


Methods of Network Attacks (continued)  Wireless Attacks (continued) 

Bluesnarfing 

Bluetooth • A wireless technology that uses short-range RF transmissions • Provides for rapid “on the fly” and ad hoc connections between devices





The IEEE 802.15.1 standard was adapted and expanded from the existing Bluetooth standard Two types of 802.15.1 network topologies • Piconet (See Figure 4-14) • Scatternet (See Figure 4-15) 43

Methods of Network Attacks (continued) 

Bluesnarfing (continued)

44

22


Methods of Network Attacks (continued) 

Bluesnarfing (continued)

45

Methods of Network Attacks (continued)  Wireless Attacks (continued) 

Bluesnarfing (continued) 



The unauthorized access of information from a wireless device through a Bluetooth connection Allows an attacker to access e-mails, calendars, contact lists, and cell phone pictures and videos • By simply connecting to that Bluetooth device without the owner’s knowledge or permission



Blue jacking 

Sending unsolicited messages from Bluetooth to Bluetooth-enabled devices 46

23


Methods of Network Attacks (continued)  Other Attacks and Frauds (pg 141) 

Null sessions 





Unauthenticated connections to a Microsoft Windows 2000 or Windows NT computer that do not require a username or a password Could allow an attacker to connect to open a channel over which he could gather information about the device Pose a serious security threat to vulnerable computers and cannot be fixed by patches to the operating systems 47

Methods of Network Attacks (continued)  Other Attacks and Frauds (continued) 

Check kiting 



A type of fraud that involves the unlawful use of checking accounts to gain additional time before the fraud is detected

Domain Name Kiting 



Registrars are organizations that are approved by ICANN to sell and register Internet domain names A five-day Add Grade Period (AGP) permits registrars to delete any newly registered Internet domain names and receive a full refund of the registration fee 48

24


Methods of Network Attacks (continued)  Other Attacks and Frauds (continued) 

Domain Name Kiting (continued) 





Unscrupulous registrars attempt to take advantage of the AGP by registering thousands of Internet domain names and then deleting them Recently expired domain names are indexed by search engines Visitors are directed to a re-registered site • Which is usually a single page Web with paid advertisement links



Visitors who click on these links generate money for the registrar

49

Summary  Network vulnerabilities include media-based vulnerabilities and vulnerabilities in network devices  The same tools that network administrators use to monitor network traffic and troubleshoot network problems can also be used by attackers  Network devices often contain weak passwords, default accounts, back doors, and vulnerabilities that permit privilege escalation  Network attacks can be grouped into four categories

50

25


Summary (continued)  Protocol-based attacks take advantage of vulnerabilities in network protocols  Attacks on wireless systems have increased along with the popularity of wireless networks  Other network attacks include null sessions, which are unauthenticated connections to a system using a legacy version of Microsoft windows  Domain Name Kiting is fraud that involves the use of a grace period to delete newly registered domain names 51

26

ET0522_Chap04_2in1  

KS Chua Lecture Singapore Polytechnic Explain the types of network vulnerabilities List categories of network attacks Define different metho...

Read more
Read more
Similar to
Popular now
Just for you