Network Security & Attacks

Network Security & Attacks?
Network Security consists of the provisions and policies adopted by a network
administrator to prevent and monitor unauthorized access, misuse, modification,
or denial of a computer network and network-accessible resources. Network
security involves the authorization of access to data in a network, which is
controlled by the network administrator. Users choose or are assigned an ID and
password or other authenticating information that allows them access to
information and programs within their authority. Network security covers a
variety of computer networks, both public and private, that are used in everyday jobs conducting
transactions and communications among businesses, government agencies and individuals. Networks
can be private, such as within a company, and others which might be open to public access. Network
security is involved in organizations, enterprises, and other types of institutions. It does as its title
explains: It secures the network, as well as protecting and overseeing operations being done. The most
common and simple way of protecting a network resource is by assigning it a unique name and a
corresponding password.
Security Management?
Security management for networks is different for all kinds of situations. A home or small office may
only require basic security while large businesses may require high-maintenance and advanced software
and hardware to prevent malicious attacks from hacking and spamming.
Types of Attacks?
Networks are subject to attacks from malicious sources. Attacks can be from two categories: "Passive"
when a network intruder intercepts data traveling through the network, and "Active" in which an
intruder initiates commands to disrupt the network's normal operation.
Types of attacks include:
 Passive
1. Network
a. Wiretapping
b. Port scanner
c. Idle scan
 Active
1. Denial-of-service attack
2. Spoofing
3. Man in the middle
4. ARP poisoning
5. Smurf attack
6. Buffer overflow
Figure 1

7. Heap overflow
8. Format string attack
9. SQL injection
10. Cyber attack
 Wiretapping
Telephone tapping (also wire tapping or wiretapping in American English) is the
monitoring of telephone and Internet conversations by a third party, often by
covert means. The wire tap received its name because, historically, the
monitoring connection was an actual electrical tap on the telephone line. Legal
wiretapping by a government agency is also called lawful interception. Passive
wiretapping monitors or records the traffic, while active wiretapping alters or
otherwise affects it.
 Port Scanner
A port scanner is a software application designed to probe a server or host for open ports. This is often
used by administrators to verify security policies of their networks and by attackers to identify running
services on a host with the view to compromise it.
Figure 2
Figure 3

A port scan or portscan can be defined as a process that sends client requests to a range of server port
addresses on a host, with the goal of finding an active port. While not a nefarious process in and of
itself, it is one used by hackers to probe target machine services with the aim of exploiting a known
vulnerability of that service. However the majority of uses of a port scan are not attacks and are simple
probes to determine services available on a remote machine.
To portsweep is to scan multiple hosts for a specific listening port. The latter is typically used to search
for a specific service, for example, an SQL-based computer worm may portsweep looking for hosts
listening on TCP port 1433.
Types
1. TCP scanning
2. SYN scanning
3. UDP scanning
4. ACK scanning
5. Window scanning
6. FIN scanning
7. Other scan types
 Idle Scan
The idle scan is a TCP port scan method that consists of sending spoofed packets to a computer to find
out what services are available. This is accomplished by impersonating another computer called a
"zombie" (that is not transmitting or receiving information) and observing the behavior of the ''zombie''
system.
Figure 4

 Denial-of-Service Attack
Denial-of-Service (DoS) or distributed denial-of-service (DDoS) attack is an attempt to make a machine
or network resource unavailable to its intended users.
Although the means to carry out, the motives for, and targets of a DoS attack vary, it generally consists
of efforts to temporarily or indefinitely interrupt or suspend services of a host connected to the
Internet.
 Spoofing
A spoofing attack is a situation in
which one person or program
successfully masquerades as another
by falsifying data and thereby
gaining an illegitimate advantage.
Figure 5
Figure 6

 Man in the Middle
In cryptography and computer security, the man-in-the-middle attack (often abbreviated to MITM,
MitM, MIM, MiM or MITMA) requires an attacker to have the ability to both monitor and alter or inject
messages into a communication channel. One example is active eavesdropping, in which the attacker
makes independent connections with the victims and relays messages between them to make them
believe they are talking directly to each other over a private connection, when in fact the entire
conversation is controlled by the attacker. The attacker must be able to intercept all relevant messages
passing between the two victims and inject new ones. This is straightforward in many circumstances; for
example, an attacker within reception range of an unencrypted Wi-Fi wireless access point, can insert
himself as a man-in-the-middle.
As an attack that aims at circumventing mutual authentication, or lack thereof, a man-in-the-middle
attack can succeed only when the attacker can impersonate each endpoint to their satisfaction as
expected from the legitimate other end. Most cryptographic protocols include some form of endpoint
Figure 7

authentication specifically to prevent MITM attacks. For example, TLS can authenticate one or both
parties using a mutually trusted certification authority.
 ARP Poisoning
ARP Spoofing/ Poisoning is a technique whereby an attacker sends fake ("spoofed") Address Resolution
Protocol (ARP) messages onto a Local Area Network. Generally, the aim is to associate the attacker's
MAC address with the IP address of another host (such as the default gateway), causing any traffic
meant for that IP address to be sent to the attacker instead.
ARP spoofing may allow an attacker to intercept data frames on a LAN, modify the traffic, or stop the
traffic altogether. Often the attack is used as an opening for other attacks, such as denial of service, man
in the middle, or session hijacking attacks.
The attack can only be used on networks that make use of the Address Resolution Protocol (ARP), and is
limited to local network segments.
Defenses
1. Static ARP entries
2. ARP spoofing detection software
3. OS security
Figure 8

 Smurf Attack
The Smurf Attack is a distributed denial-of-service attack in which large numbers of Internet Control
Message Protocol (ICMP) packets with the intended victim's spoofed source IP are broadcast to a
computer network using an IP Broadcast address. Most devices on a network will, by default, respond to
this by sending a reply to the source IP address. If the number of machines on the network that receive
and respond to these packets is very large, the victim's computer will be flooded with traffic. This can
slow down the victim's computer to the point where it becomes impossible to work on.
 Buffer Overflow
In computer security and programming, a buffer overflow, or buffer overrun, is an anomaly where a
program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent
memory. This is a special case of violation of memory safety.
Buffer overflows can be triggered by inputs that are designed to execute code, or alter the way the
program operates. This may result in erratic program behavior, including memory access errors,
incorrect results, a crash, or a breach of system security. Thus, they are the basis of many software
vulnerabilities and can be maliciously exploited.
Programming languages commonly associated with buffer overflows include C and C++, which provide
no built-in protection against accessing or overwriting data in any part of memory and do not
automatically check that data written to an array (the built-in buffer type) is within the boundaries of
that array. Bounds checking can prevent buffer overflows.
Figure 9

Exploitation
1. Stack-based exploitation
2. Heap-based exploitation
3. Barriers to exploitation
4. Practicalities of exploitation
a. NOP sled technique
b. The jump to address stored in a register technique
Protective Countermeasures
1. Choice of programming language
2. Use of safe libraries
3. Buffer overflow protection
4. Pointer protection
5. Executable space protection
6. Address space layout randomization
7. Deep packet inspection
Figure 10

 Heap Overflow
A heap overflow is a type of buffer overflow that occurs in the heap data area. Heap overflows are
exploitable in a different manner to that of stack-based overflows. Memory on the heap is dynamically
allocated by the application at run-time and typically contains program data. Exploitation is performed
by corrupting this data in specific ways to cause the application to overwrite internal structures such as
linked list pointers. The canonical heap overflow technique overwrites dynamic memory allocation
linkage (such as malloc meta data) and uses the resulting pointer exchange to overwrite a program
function pointer.
 Format String Attack
Uncontrolled format string is a type of software vulnerability, discovered around 1999, that can be used
in security exploits. Previously thought harmless, format string exploits can be used to crash a program
or to execute harmful code. The problem stems from the use of unchecked user input as the format
string parameter in certain C functions that perform formatting, such as “printf()”.A malicious user may
use the “%s” & “%x” format tokens, among others, to print data from the stack or possibly other
locations in memory. One may also write arbitrary data to arbitrary locations using the “%n” format
token, which commands “printf()”and similar functions to write the number of bytes formatted to an
address stored on the stack.
 SQL Injection
SQL injection is a code injection technique,
used to attack data-driven applications, in
which malicious SQL statements are
inserted into an entry field for execution
(e.g. to dump the database contents to the
attacker). SQL injection must exploit a
security vulnerability in an application's
software, for example, when user input is
either incorrectly filtered for string literal
escape characters embedded in SQL
statements or user input is not strongly
typed and unexpectedly executed. SQL
injection is mostly known as an attack vector for websites but can be used to attack any type of SQL
database.
In a 2012 study, security company Imperva observed that the average web application received 4 attack
campaigns per month, and retailers received twice as many attacks as other industries.
Figure 11

Technical implementations
1. Incorrectly filtered escape characters
2. Incorrect type handling
3. Blind SQL injection
a. Conditional responses
b. Second Order SQL Injection
Mitigation
1. Parameterized statements
a. Enforcement at the coding level
2. Escaping
3. Pattern check
4. Database permissions
 Cyber Attack
Cyber-attack is any type of offensive maneuver employed by individuals or whole organizations that
targets computer information systems, infrastructures, computer networks, and/or personal computer
devices by various means of malicious acts usually originating from an anonymous source that either
steals, alters, or destroys a specified target by hacking into a susceptible system. These can be labelled
as either a Cyber campaign, cyberwarfare or cyberterrorism in different context. Cyber-attacks can
range from installing spyware on a PC to attempts to destroy the infrastructure of entire nations. Cyber-
attacks have become increasingly sophisticated and dangerous as the Stuxnet worm recently
demonstrated.
Figure 12

Factors for cyber-attacks
1. Fear factor
2. Spectacular factor
3. Vulnerability factor

Network Security & Attacks

Recommended

More Related Content

What's hot (20)

Viewers also liked (19)

Similar to Network Security & Attacks (20)

More from Netwax Lab (20)

Recently uploaded (20)

Network Security & Attacks