Network Security

Front 1

Lets start off with some network attacks.

There are a couple so we'll begin with some terminology.

What is TCP?

Back 1

TCP stands for Transmission Control Protocol, it is a way to communicate from one computer to another over an IP network.

Front 2

To establish a TCP connection what sort of method do you use?

Back 2

TCP-3-way handshake

Front 3

What is the TCP-3-way handshake process?

Back 3

1. Host A sends a TCP SYNchronize packet to Host B

2. Host B sends a SYNchronize-ACKnowledgement

3.Host A sends ACKnowledge

4.TCP socket connection is ESTABLISHED.

Front 4

What kind of DOS attack can be used against this handshake?

Back 4

SYN Flood attack

Front 5

How does the SYN Flood attack work?

Back 5

Hacker sends a large number of SYN packets and never acknowledge any of the replies. (Doesn't send ACK code)

Victim tries to establish TCP connection starting by sending SYN. This fails because all space for connections are allocated, leaving the victim without service.

Front 6

What are some countermeasures for the SYN flood attack?

Back 6

1.Filtering

2.Increasing Backlog

3.Reducing SYN-RECEIVED Timer

4.Recycling the Oldest Half-Open TCP

5.SYN Cache

6.SYN cookies

7.Hybrid Approaches

8.Firewalls and Proxies

Front 7

A DOS SYN Flood attack is between 2 hosts that effect everyone else, if I want to cripple the victims server (aka ONLY their computer) what would I do?

Back 7

Amplification Attack

Front 8

What is an Amplified Network Attack?

Back 8

exploit network protocol vulnerabilities to increase the traffic sent to a victim’s system

Front 9

What is a type of Amplified Network (DOs) Attack?

Back 9

The Smurf Attack

Front 10

How does the Smurf Attack work?

Back 10

Back in the day Internet Control Message Protocol (ICMP) packets were used to check if computers on a LAN were alive (pinging).

The attack works when the intended victim's spoofed source IP are broadcast to a computer network using an IP Broadcast address.

Most devices on a network will, by default, respond to this by sending a reply to the source IP address.

If the number of machines on the network that receive and respond to these packets is very large, the victim's computer will be flooded with traffic. This can slow down the victim's computer to the point where it becomes impossible to work on.

Front 11

Once Denial of Service attacks (Dos) slowly were stopped/came to a close what did hackers turn to?

Back 11

Distributed Denial of Service Attacks

Front 12

What is a Distributed Denial of Service attack?

Back 12

A brute force method, for example by sending floods of UDP packets from infected machines

Front 13

In DDoS, the attacker subverts a large number of machines over a period of time and, or on a given signal, these machines all start to bombard the target with traffic... What are these infected machines called?

Back 13

Botnets

Front 14

What is a botnet?

Back 14

a network of private computers infected with malicious software and controlled as a group without the owners' knowledge

Front 15

What is a DNS?

Back 15

Domain Name Servers (DNS) are the Internet's equivalent of a phone book. They maintain a directory of domain names and translate them to Internet Protocol (IP) addresses. This is necessary because, although domain names are easy for people to remember, computers or machines, access websites based on IP addresses.

Front 16

what is an Amplified DNS attack?

Back 16

A Domain Name Server (DNS) amplification attack is a popular form of distributed denial of service (DDoS) that relies on the use of publically accessible open DNS servers to overwhelm a victim system with DNS response traffic.

Front 17

How does an amplified DNS attack work?

Back 17

A hacker will send queries with a forged IP address (the victim’s) to a DNS server, in turn, reply to that forged address, and overwhelm the victims system

Front 18

what is another form of an amplified DOS attack?

Back 18

Amplification Attacks using SNMP

Front 19

What is SNMP?

Back 19

Simple Network Management Protocol (SNMP) - a common network management protocol used for configuring and collecting information from network devices like servers, hubs, switches, routers and printers.

Front 20

How does the SNMP amplification attack work?

Back 20

The same as a DNS amplification attack, except it uses a SNMP instead of a DNS, whereby numerous connected devices will respond overwhelming the victims server

Front 21

In summary, the attacks discussed so far affected 1 of the three CIA triads. What attacks discussed affected Availability?

Back 21

DoS (Denial of Service)

DDoS (Distributed Denial of Service)

SYN Flood

Front 22

What attacks often rely on the need tolook up resources by some name or ID?

Back 22

Attacks on Confidentiality and Integrity

Front 23

What are three DNS attacks?

Back 23

1) ID Spoofing with Sniffing
2) Proving your own answer

3) DNS cache poisoning

Front 24

Explain ID spoofing with sniffing

Back 24

Front 25

Explain "providing your own answer" DNS attack?

Back 25

1. Attacker floods local DNS server with hundreds of queriesfor www.CIBC.com

2. Attacker then floods DNS server with hundreds of spoofedreplies that appear to come from ns.cibc.com (CIBC’sauthoritative name server)

3. Local DNS server is now “poisoned” with false data

Front 26

What is DNS cache poisoning?

Back 26

DNS spoofing (or DNS cache poisoning) is a computer hacking attack, whereby data is introduced into a Domain Name System (DNS) resolver's cache, causing the name server to return an incorrect IP address, diverting traffic to the attacker's computer (or any other computer).

Front 27

Explain cache poising steps (summary)

Back 27

-Attacker sends a request to your local DNS asking it to resolvewww.attacker.net

-Your local DNS server queries ns.attacker.net for the data

-ns.attacker.net replies, but also includes false information onwww.cnn.com

-Your DNS server caches the false data on www.cnn.com

Front 28

Attacks are easy to be pulled off because certain network tools are available. Name one of them...

Back 28

shrinkwrapped

Front 29

What is ARP spoofing?

Back 29

ARP spoofing is a type of attack in which a malicious actor sends falsified ARP (Address Resolution Protocol) messages over a local area network. This results in the linking of an attacker's MAC address with the IP address of a legitimate computer or server on the network.

Front 30

How is a Bot recruited?

Back 30

Drive-by-download

Front 31

What is a Drive-by-download?

Back 31

A malicious program whichmisrepresents itself as useful,routine, or interesting in order topersuade a victim to inVstall it.

Front 32

What is the difference between a Trojan, a Worm and a Virus?

Back 32

Trojan - a program thatdoes something malicious (such as capturing passwords) when run by anunsuspecting user

Worm - something that replicates

Virus - is aworm which replicates by attaching itself to other programs.

Front 33

What is a rootkit?

Back 33

a piece of softwarethat once installed on a machine surreptitiously places it under remotecontrol.

Front 34

What is an example of a dangerous trojan virus?

Back 34

Zeus

Front 35

What are the two major components of a virus/worm?

Back 35

A virus or worm typically has two components:

1) Replication Mechanism

2) Payload

Front 36

How does a worm execute it's replication mechanism?

Back 36

The worm located on the infected computer will scan the network (or internet) to locate computers with security flaw that have not been patched. Worm repeats cycle on that computer to locate more computers to infect

Front 37

How does a virus execute it's replication mechanism?

Back 37

thecommonest way for a virus to replicate was to append itself to an executablefile and patch itself in, so that the execution path jumps to the virus code andthen back to the original program.

Front 38

What is the payload of a virus/worm?

Back 38

Doing a certain number of malicious activities, usually activated after a trigger (ie. a certain date)

Front 39

What is a C&C server?

Back 39

command-and-control server (C&C server) is the centralized computer that issues commands to a botnet (zombie army) and receives reports back from the coopted computers.

Front 40

What kinds of C&C architectures are there?

Back 40

1. Traditional

2. Peer-2-peer

Front 41

What are fast-flux networks?

Back 41

a weapon against decapitation

Front 42

What are the two kinds of fast-flux?

Back 42

Single Flux - multiple nodes register and deregister their IP addresseswith the same DNS name

Double Flux - multiple nodes register and deregister their IP addresseswith Name Server records

Front 43

How would you detect malicious fast-flux networks?

Back 43

1. For single flux the logic would be One Domain - Large IP records in a day

2. For double flux the logic would be One Domain - Large NS records in a day

3. Correlation with the ANS data collection would give a clear picture of weather the Fast flux trigger is false positive or not

Front 44

How would you defend against botnets?

Back 44

• Prevent recruitment

• patch vulnerabilities

• intrusion detection / anti-malware measures

• signature based

• anomaly based

• Detect and recover from malware• Take out C&C