Please enable JavaScript.

Coggle requires JavaScript to display documents.

Network Attacks - Coggle Diagram

- - - - Mitigate this with
        defence in depth
        
        Defence at all levels
        and covering all bases
- - - - either unintentional or
        purposely malicious
      - MITIGATE moving away from jam
        or
        locate source of jam
        or
        boost signal
        
        Some devices have
        signal power levels
        
        Devices can locate signals
      - Like traffic jam
        
        Too many signals
- - - - increase in smaller electronics
        aka smaller devices,
        has lead to a need for
        smaller wireless connections
        
        aka
        Short range
        wireless communication
        protocols/technologies
        
        Bluetooth
        
        2 main types
        of attacks,
        involves infiltrating or exfiltrating data
        
        Infiltrating,
        as in sending data or
        getting inside
        
        Bluejacking
        
        1 more item...
        
        Exfiltration,
        basically extracting data
        
        known as
        Blue snarfing
        
        1 more item...
        
        Another form of short range
        wireless communication
        
        used by devices other than
        phones
        
        NFC
        (Near Field Communication)
        
        Basically at set of
        standards for contactless
        communication
        
        1 more item...
        
        A similar technology to
        NFC, but older
        and is one way
        
        known as
        RFID
        (Radio Frequency Identification)
        
        RFID uses electromagnetic
        fields
        
        Consists of a tag (or chip) and
        RFID reader
        
        1 more item...
      - Wireless Network
        
        Need a way to access and reach
        wireless network
        
        use
        Access Point
        (to access wireless network,
        basically acts as a bridge to network)
        
        Threat Actor can setup
        Rogue Access Point
        aka Rogue AP
        
        Rogue Access Point
        allows the attacker to intercept
        network traffic aka
        Man In The Middle Attack
        
        MITM
        is known as
        Evil Twin Attack
        
        2 more items...
        
        Rogue AP
        has stronger signal
        than legit AP
        
        data sent across network to devices
        requires encryption
        
        Encryption uses a key
        
        using the same key frequently,
        can be unsecure (if actor gets hold of key
        they can intercept and decrypt all traffic)
        
        so a functionality is needed to
        scramble the key or add on the key
        
        functionality is known as
        Initialization Vector (IV)
        
        1 more item...
- - - - Domain expires
      - Domain registrar is exploited
      - Domain Owner is
        social engineered
  - - - EX “example.com/banktransfer/example.php?url=http ://malicious-site
  - - - Threat Intelligence against
        malicious domains
  - - - DNS query is made
        
        to recursive
        and authoritative servers
        
        recursive cache can updated
        to include malicious record
        
        attacker can setup
        malicious recursive server
        
        then returns malicious record
        
        returns malicious site
        
        code injections
        
        malicious browser extensions
        
        downloads trojans etc
    - - Check DNS config
      - Notification for DNS
        settings change
      - Disable recursive
        requests for other networks
      - Disable open recursive
        requests
        
        open recursive does
        not check origin
- - - - EX Media
        Access Control flooding
        
        System is unable to handle
        excess packets,
        causes unexpected behaviour
  - - - IS multiple ICMP ping
        packets sent to broadcast address
        
        Original source ip for packets
        is set to victims IP
        
        Means flood of
        traffic is returned to
        victims ip
      - Name is based on
        idea of small attackers
        working together to
        overwhelm larger opponent
        
        Hence smurf
    - - IS similar to Smurf
        
        Uses UDP (instead of
        ICMP) to send
        spoofed packets
        to broadcast address
    - - IS sending
        flood of ping packets
        direct to victim
        
        Ping of Death
        
        Sends large sized packets
        to target
    - - Sends flood of SYN
        packets to target
        
        This creates
        half open connection
        (as in 3way handshake)
        
        Target system is unable
        to handle amount of
        SYN packet requests
    - - IS spoofing SYN packets,
        by setting source and destination
        to the same address
        
        And same source
        destination ports
        
        The end systems
        becomes confused
    - - Exploits vulnerability
        in UDP
        
        IS based on sending
        fragmented UDP packets,
        with odd offsets
        
        receiving machine, is
        unable to rebuild packets
        
        due to offset
    - - Understand type of
        attack
      - End point
        detection systems
      - Setup router filters
        to drop malicious packets
        
        Also filter to stop
        packets with internal source ip
        
        Ping won't work
      - Keep system up to date
      - Keep up to date on
        cyber sec news
  - - - Zombie software
        is installed on
        victim machines
        
        Each machine is
        used to flood with
        DoS
    - - Attacker uses
        3rd party service to attack
        and spoofs victims
        ip
        
        All subsequent
        packets
        are returned to victims
        machine
        
        EX 3rd party services
        include Network time
        and DNS servers
        
        Anything returned
        will go back to victim
      - Amplification
        
        Attack is amplified or
        multiplied even more
        
        Attacker can request 3rd party
        service using botnets
        (zombies)
        
        Request is made
        with spoofed victims ip
        
        All responses
        are returned to attacker
        
        Victims machine
        is flooded
        
        EX 3rd party
        is DNS resolver
  - - - Attack targets
        web servers and
        applications
        
        EX sending
        flood of GET and POST
        requests
      - Attacks on Operational
        technology
        
        OT is exposed to internet
        e.g. IoT, electrical grids,
        smart cities, manufacturing, CCTV
        
        Therefore easier
        to target and access
- - - - Fileless viruses
      - Macro Viruses
    - - Python
      - Powershell
      - Bash
      - VBA
        (visual basic for applications)
- - - - Network switches
        use layer 2
        
        Layer 2's functionalities and protocols,
        can be target and exploited for attacks
        
        Address Resolution Protocol
        (ARP)
        
        ARP is used to request
        a MAC address for
        a specific IP
        
        the ARP request is
        broadcasted to network
        
        owner of IP,
        responds with their
        MAC (physical address)
        
        1 more item...
        
        Another form of attack
        using ARP
        
        Port Stealing
        
        IS attacker sends lots
        of packets to switch with
        source as victims IP and destination
        is attackers MAC
        
        1 more item...
        
        Media Access Control
        (MAC) Address
        
        MAC Flooding
        
        IS attack on network
        switches
        
        Attacker floods switch
        with frames with from different addresses
        
        1 more item...
        
        MAC Spoofing
        
        IS faking or imitating
        a MAC address for a device
        
        Spoofing is faking
        some kind of ID
        to gain access
        
        1 more item...
- - - - attacker acts(pretends) as server, to victim (client)
        and client (to the server)
        
        aka
        Man In The Middle
        Attack
        
        aka
        On-Path Attack
        
        on-path attacks,
        can be performed on
        Domain Name System (DNS)
        specifically resolver server
        
        redirects resolver requests
        to malicious server
        
        known as
        DNS (cache) poisoning
        
        1 more item...