20) Network Attacks

Comprehensive Overview of Malware

  • Definition: Malware, short for malicious software, refers to any software intentionally designed to cause damage to a computer, server, client, or computer network.
  • Categories of Threat: Malware is a critical threat that encompasses a wide range of harmful or intrusive software types, including:
    • Viruses
    • Worms
    • Trojan horses
    • Ransomware
    • Spyware
    • Keyloggers
    • Logic bombs
    • Rootkits

Viruses: Characteristics and Mechanisms

  • Fundamental Nature: A virus is malicious software designed to spread to other computers by attaching itself to legitimate software.
  • Execution: It executes its code specifically when the host software is run by a user.
  • Propagation Requirements: Unlike other self-spreading malware, viruses typically require user action to replicate, such as opening a specific file or running a program.
  • Infection Mechanisms:
    • File Infector Viruses: These attach to executable files and spread to other executables when the program is initially run.
    • Macro Viruses: These are written in application-specific macro languages (e.g., Microsoft Word) and are spread through infected documents.
    • Boot Sector Viruses: These infect the Master Boot Record (MBR) of a hard drive, ensuring the virus executes every time the computer boots up.
  • Detection and Removal Strategies:
    • Antivirus Software: Utilizes signatures to detect known viruses and heuristics to identify new, previously unknown variants.
    • Regular Updates: It is crucial to keep antivirus software updated with the latest virus definitions for effective protection.
    • System Scans: Periodic scanning is necessary to detect and remove threats from the system.

Worms: Self-Replicating Network Threats

  • Definition: A worm is malware that replicates itself to spread to other computers.
  • Distinguishing Features: Unlike a virus, a worm does not need to attach to an existing program and does not require user intervention to propagate.
  • Exploitation: Worms typically exploit vulnerabilities in network services to move across networks autonomously.
  • Mitigation and Preventive Steps:
    • Patch Management.
    • Antivirus and Antimalware Solutions.
    • Network Segmentation and Access Controls.
    • Firewalls and Traffic Filtering.
    • Disabling Unnecessary Services.
    • User Training and Awareness.

Trojan Horses: Deception-Based Malware

  • Definition: A Trojan (short for Trojan horse) is malware that disguises itself as legitimate software or is hidden within it.
  • Origin of Term: Named after the ancient Greek strategy involving a deceptive wooden horse that caused the fall of Troy.
  • Operation: The software tricks users into loading and executing it on their systems.
  • Defense Measures:
    • Patch Management.
    • Antivirus and Antimalware Solutions.
    • Network Segmentation and Access Controls.
    • Firewalls and Traffic Filtering.
    • User Training and Awareness.

Ransomware: Availability and Financial Threats

  • Core Function: Designed to block access to a computer system or encrypt files until a sum of money is paid.
  • Payment Method: Demands are typically made in the form of cryptocurrency.
  • Primary Characteristics:
    • Encryption: Locking down data so it is inaccessible to the owner.
    • Payment Demand: A direct threat to data availability and business operations.
  • Distribution Methods: Spread via phishing emails, malicious web advertisements, and software/network vulnerabilities.
  • Wana Decryptor 2.0 (Example Case):
    • Displays a message: "Ooops, your files have been encrypted!"
    • Claims documents, photos, videos, and databases are inaccessible without a decryption service.
    • Time Constraints: Provides a 33-day window before the price is doubled. If payment is not received in 77 days, files are purportedly lost forever.
    • Financial Specifics: Example demand of $300\$300 worth of Bitcoin to a specific address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw.
    • Check Times: Recommends checking payment between 9:00am9:00\text{am} and 11:00am11:00\text{am}.
  • Protection and Mitigation:
    • Data Backups (critical for recovery).
    • Patch Management, Firewalls, and Traffic Filtering.
    • User Training and Education.

Spyware: Unauthorized Surveillance and Data Collection

  • Definition: Malware designed to gather data from a user or organization without their knowledge or consent.
  • Types of Data Collected: Internet usage data, login credentials, and confidential information.
  • Key Characteristics:
    • Data Collection: Logging keystrokes, capturing screen images, recording browsing history, and accessing files.
    • Surveillance: Activating cameras and microphones to monitor the physical environment.
    • Stealth: Runs hidden in the background, often disguised as legitimate software.
    • Communication: Transmits collected data to a third party (cybercriminal).
  • Mitigation Measures:
    • Patch Management and Firewalls.
    • Antivirus and Anti-Spyware Software.
    • Developing Secure Browsing Habits.
    • User Training and Awareness.

Rootkits: Privileged Persistence

  • Definition: A clandestine computer program designed to provide continued privileged access to a system while actively hiding its presence from administrators.
  • Installation: Can be installed by an intruder after gaining initial access or by piggybacking on other software.
  • Defense and Detection:
    • Secure System Access and System Hardening.
    • Antivirus and Anti-Rootkit Tools.
    • Patch Management.
    • Secure Boot: Using hardware and software that supports secure boot processes to prevent unauthorized code from running at startup.

Logic Bombs: Conditional Malicious Code

  • Definition: Code inserted into a software system that triggers a malicious function when specific conditions are met.
  • Non-Replicating: Unlike viruses, logic bombs do not copy themselves.
  • Triggers: Date/time, the launch of a specific program, deletion of a user account, or a specific command.
  • Key Characteristics:
    • Condition-based Trigger: Activated by logic written into the code.
    • Malicious Intent: Activities include deleting files or corrupting data.
    • Stealth: Remains dormant and hard to detect until the trigger occurs.
    • Insider Threat: Often deployed by disgruntled employees with legitimate system access.
  • Defense Strategies:
    • Code Reviews and Auditing.
    • Access Controls and Change Management.
    • Regular Backups and Security Awareness Training.

Distributed Denial-of-Service (DDoS) Attacks

  • Objective: To disrupt normal traffic of a targeted server or network by overwhelming it with a flood of Internet traffic.
  • Resources: Utilizes multiple compromised systems (botnets), including computers and IoT devices.
  • Attack Types:
    • Network-Based DDoS: Multiple compromised systems launch a single massive attack.
    • UDP Floods: Attacker overwhelms random ports on a host with IP packets containing UDP datagrams to crash the system.
    • SYN Floods: Targets the TCP three-way handshake. The system is overwhelmed by connection requests and cannot respond to legitimate traffic.
    • Amplification Attacks: Exploits protocols (like DNS or IP Addressing) to magnify the traffic volume sent to a target.
    • Reflected DDoS: Attacker forces third-party servers to direct traffic to a victim, often using IP Spoofing.
  • Mitigation Techniques:
    • Increasing Bandwidth.
    • DDoS Protection Services (e.g., Cloudflare).
    • Network Hardware (routers/firewalls) with built-in DDoS protection.

Network Layer and Protocol Attacks

  • VLAN Hopping: Exploiting vulnerabilities to send packets from one VLAN to another, bypassing Layer 22 security to access sensitive data.
  • MAC Flooding: Overwhelming a switch with fake MAC addresses, forcing it into "fail-open" mode. The switch then acts like a hub, broadcasting traffic to all ports, allowing for data interception.
  • ARP Spoofing/Poisoning: Sending falsified ARP (Address Resolution Protocol) messages to link an attacker's MAC address with a legitimate IP address. This facilitates interception, modification, or blocking of data (on-path attacks).

Domain Name System (DNS) Vulnerabilities

  • Function of DNS: Translates human-readable domain names into numerical IP addresses.
  • Security Concerns:
    • DNS Spoofing (Cache Poisoning): Corrupting the DNS cache with false info to redirect traffic to fraudulent sites.
    • DNS Amplification: A type of DDoS where small queries generate large responses to flood a target.
    • DNS Tunneling: Encoding data of other protocols in DNS queries/responses to exfiltrate data.
    • DNS Hijacking: Diverting queries to malicious DNS servers by compromising the server or changing victim device settings.
  • Mitigation Strategies:
    • DNSSEC (DNS Security Extensions): Ensures responses are from the correct source and untampered.
    • Securing Servers: Regular patching and monitoring DNS traffic for unusual patterns.

Rogue Devices and On-Path Attacks

  • Rogue Devices: Unauthorized hardware (computers, access points) connected to a network without permission.
    • Rogue DHCP Server: Provides incorrect IP addresses, leading to network disruption or traffic redirection through an attacker's machine.
    • Rogue Access Point (AP): Unauthorized Wi-Fi AP installed without consent.
    • Evil Twin: A malicious AP masquerading as a legitimate one by using the same SSID to deceive users.
  • On-path Attack (formerly Man-in-the-Middle):
    • Positioning: The attacker is in the communication path between two parties.
    • Methods: Intercepting traffic via compromised equipment, unsecured Wi-Fi, or ARP spoofing.
    • Eavesdropping: Passively listening to gain credentials or corporate data.
    • Session Hijacking: Stealing session tokens to impersonate a victim.
    • Data Manipulation: Altering communication, injecting malicious content, or redirecting users.
    • SSL Stripping: Downgrading secure HTTPS connections to unencrypted HTTP to view/modify data.

Social Engineering and Physical Security

  • General Concept: Tricking people into breaking security procedures through human interaction.
  • Phishing: Objectives include credential theft, financial fraud, and malware distribution. Mitigation includes email filtering, 2FA, and user education.
  • Dumpster Diving: Retrieving sensitive information (passwords, financial records) from discarded materials. Mitigation involves shredding and secure data wiping.
  • Shoulder Surfing: Watching someone enter PINs or passwords over their shoulder.
  • Tailgating: Following an authorized individual into a restricted area without their knowledge to breach physical security.