More Related Content
What's hot
What's hot (20)
Similar to 501 ch 7 protecting against advanced attacks
Similar to 501 ch 7 protecting against advanced attacks (20)
More from gocybersec
More from gocybersec (11)
Recently uploaded
Recently uploaded (20)
501 ch 7 protecting against advanced attacks
- 1. Proprietary & Confidential @GoCyberSec | January, 2020 Chapter 7 Protecting Against Advanced Attacks CompTIA Security +
- 2. Proprietary & Confidential @GoCyberSec | January, 2020 Introduction • Comparing common attacks • Summarizing secure coding concepts • Identifying application attacks • Understanding frameworks and guides
- 3. Proprietary & Confidential @GoCyberSec | January, 2020 Common Attacks • Privilege escalation – Gain additional privileges after initial exploit • Spoofing – Impersonating or masquerading as someone or something else – MAC spoofing – IP spoofing – Email spoofing
- 4. Proprietary & Confidential @GoCyberSec | January, 2020 Common Attacks • SYN flood attack – Common attack against Internet servers – Disrupts the TCP three-way handshake – Withholds 3rd packet
- 5. Proprietary & Confidential @GoCyberSec | January, 2020 Common Attacks • Man-in-the-middle – Active interception – Active eavesdropping • ARP poisoning
- 6. Proprietary & Confidential @GoCyberSec | January, 2020 DNS Attacks • DNS poisoning /spoofing –Attempt to corrupt DNS data –Protect against with DNSSEC • Pharming –Redirects a web site’s traffic to another web site • DDoS DNS attacks –DNS amplification attack
- 7. Proprietary & Confidential @GoCyberSec | January, 2020 Amplification Attack • Smurf – A ping is normally unicast – Smurf attack sends the ping out as a broadcast – Smurf attack spoofs the source IP – Directed broadcast through an amplifying network – Disable directed broadcasts on border routers
- 8. Proprietary & Confidential @GoCyberSec | January, 2020 Password Attacks • Brute Force Attacks –Attempts to guess all possible character combination • Dictionary Attack –Uses a dictionary of words and attempts every word in the dictionary • Password hashes attack –Password: IC@nP@$$S3curity+ –Hash 75c8ac11c86ca966b58166187589cc15
- 9. Proprietary & Confidential @GoCyberSec | January, 2020 Password Attacks • Pass the hash –Attacker discovers the hash –Attacker uses the hash to log on –Older protocols susceptible • Microsoft LAN Manager (LM) • NT LAN Manager (NTLM) • Use NTMLv2 instead • Birthday attack –Birthday paradox –Hash collision –Prevent attack with strong hashing • Rainbow table attack –Prevent with salted hashes
- 10. Proprietary & Confidential @GoCyberSec | January, 2020 Common Attacks • Replay –Replays data in an attempt to impersonate client –Timestamps and sequence numbers are effective countermeasures • Can be –An application/service attack –A wireless attack –A cryptographic attack
- 11. Proprietary & Confidential @GoCyberSec | January, 2020 Common Attacks • Known plaintext – Attacker has samples of both the plaintext and the ciphertext • Compare with chosen plaintext The information contained in this email and any accompanying attachments may contain proprietary information about the Pay & Park & Pay parking garage. Nr55tySu3IFIf7f3Cjn540fSs0j0QbshCN0yOAvhN3UKr85uEkvawEPG3lhLIklwBz7hBzhaRZ96KUYIT3 wQbf2cSkWHtN8ZQrQ+ZGJHhe8HkL42CPjHIGc0HW4urJ+NNLnNxqHyRo34azbnXsd3qd3Ce5GE7 blWtY0duwNKy0xqhmDihUJs9nDhXBV4nBkZ6shcmKGEUSyvCr/hOEpAYw==
- 12. Proprietary & Confidential @GoCyberSec | January, 2020 Common Attacks • Typo squatting / URL hijacking • Attackers purchase similar domain names for various malicious purposes • Users visit the typo squatting domain when they enter the URL incorrectly with a common typo • Clickjacking • Tricks users into clicking something different • Typically uses frames
- 13. Proprietary & Confidential @GoCyberSec | January, 2020 Common Attacks • Session hijacking - Impersonate the user with the session ID - Session IDs stored in cookies • Domain hijacking - Attacker changes the registration of the domain name - Typically done by using social engineering techniques to guess owner’s password
- 14. Proprietary & Confidential @GoCyberSec | January, 2020 Common Attacks • Man-in-the-browser attack –Type of proxy Trojan horse –Can capture browser session data • Driver manipulation –Shimming –Refactoring
- 15. Proprietary & Confidential @GoCyberSec | January, 2020 Common Attacks • Zero-day vulnerabilities –Undocumented and unknown to the public –Vendor might know about it, but has not yet released a patch to address it • Zero day attack –Attempts to exploit zero-day vulnerabilities –Also known as zero day- exploit
- 16. Proprietary & Confidential @GoCyberSec | January, 2020 Memory Buffer Vulnerabilities • Memory leak - App consumes more and more memory - Can crash operating system • Integer overflow - App attempts to use or create numeric value too big for the available storage - 8-bit storage - 95 x 59 = 5,605 (needs at least 13 bits to store)
- 17. Proprietary & Confidential @GoCyberSec | January, 2020 Memory Buffer Vulnerabilities • Buffer overflow and buffer overflow attack - Occur when an application receives data that it can’t handle - Exposes system memory - Often includes NOP instructions (such as x90) - Can then insert malicious code into memory - Input validation helps prevent buffer overflow attacks
- 18. Proprietary & Confidential @GoCyberSec | January, 2020 Secure Coding Concepts • Compiled code • Optimized • Run as an executable • Compiler checks the program for errors and • Runtime code • Code is evaluated, interpreted, and executed when the code is run • HTML is interpreted by web browsers and displayed as web pages
- 19. Proprietary & Confidential @GoCyberSec | January, 2020 Secure Coding Concepts • Input Validation • Verifies validity of data before using it - Verifies proper characters - Uses boundary and/or range checking - Blocks HTML code - Prevents the use of certain characters • Client-side vs server-side - Server-side is more secure (many sites use both) • Input validation prevents - Buffer overflow, SQL injection, command injection, and cross-site scripting attacks
- 20. Proprietary & Confidential @GoCyberSec | January, 2020 Secure Coding Concepts • Avoid race conditions - Occur when two modules attempt to access the same resource - First module to complete the process wins - Database locks prevent race conditions • Error and Exception Handling - Catch errors and provides feedback • Prevent improper input from crashing an application providing information to attackers • Errors to users should be general • Logged information should be detailed
- 21. Proprietary & Confidential @GoCyberSec | January, 2020 Secure Coding Concepts • Code reuse - Avoid dead code • Software development codes (SDKs) - Provide software tools easy to reuse • Code obfuscation - Camouflage code
- 22. Proprietary & Confidential @GoCyberSec | January, 2020 Code Quality and Testing • Static code analyzers • Dynamic analysis • Stress testing • Sandboxing • Model verification • Fuzzing • Sends random strings of data to applications looking for vulnerabilities • Attackers use to detect strings of data that can be used in an attack • Administrators use fuzz testing to test applications
- 23. Proprietary & Confidential @GoCyberSec | January, 2020 SDLC Models Software development life cycle (SDLC) models • Waterfall –Multiple stages going from top to bottom –Strict • Agile –Starts with set of principles –Uses iterative cycles with incremental changes –Flexible
- 24. Proprietary & Confidential @GoCyberSec | January, 2020 Secure DevOps • Security automation • Continuous integration • Baselining • Immutable systems • Infrastructure as code
- 25. Proprietary & Confidential @GoCyberSec | January, 2020 Secure Coding Concepts • Change management – Ensures developers do not make unauthorized changes – Provides accounting structure • Version control – Tracks software versions – Identifies who made the change and when • Provisioning (an application) – Preparing to deploy it – Configuring for different applications • Deprovisioning (an application) – Removing it completely
- 26. Proprietary & Confidential @GoCyberSec | January, 2020 Secure Coding Concepts • Web servers host web sites – Apache – IIS • Protected by placing in DMZ
- 27. Proprietary & Confidential @GoCyberSec | January, 2020 Database concepts • Tables related to each other with keys • Database schema
- 28. Proprietary & Confidential @GoCyberSec | January, 2020 Database concepts • Tables –Rows (also called records or tuples) –Columns (also called attributes) –Cells hold individual values (such as “Lisa”)
- 29. Proprietary & Confidential @GoCyberSec | January, 2020 Database concepts Normalization • Organizing tables and columns to reduce redundant data and improve performance • First normal form (1NF) • Second normal form (2NF) • Third normal form (3NF)
- 30. Proprietary & Confidential @GoCyberSec | January, 2020 SQL Queries • Used to access data • Commonly used with web pages
- 31. Proprietary & Confidential @GoCyberSec | January, 2020 SQL Queries SELECT * FROM Customers WHERE name = 'Homer Simpson‘ Using SQL Injection SELECT * FROM Customers WHERE name = ' ' or '1'='1' --' Result SELECT * FROM Customers WHERE name = ' ' SELECT * FROM Customers WHERE '1'='1'
- 32. Proprietary & Confidential @GoCyberSec | January, 2020 SQL Injection Attack • Used on unprotected web pages to access backend databases • Often use the phrase ' or '1'='1 ' • Tricks database into providing information • Best protection –Input validation & stored procedures • XML injection (similar to SQL injection)
- 33. Proprietary & Confidential @GoCyberSec | January, 2020 Application Attacks Other injection attacks • Command injection attack –Attempts to run operating system commands from within an application • Cross-site scripting (XSS) –Attackers embed malicious HTML or JavaScript code –Can be in web site or links in email –Prevented with server-side input validation –OWASP recommends use of library
- 34. Proprietary & Confidential @GoCyberSec | January, 2020 Application Attacks • Cross-site request forgery (XSRF) –Causes users to perform actions on websites without their knowledge –Attackers can use to steal cookies and harvest passwords –XSRF tokens successfully block this attack
- 35. Proprietary & Confidential @GoCyberSec | January, 2020 Frameworks and Guides • Frameworks –Regulatory –Non-regulatory –National versus international –Industry-specific • Guides –Vendor-specific –Platform-specific –Role- or goal-specific
- 36. Proprietary & Confidential @GoCyberSec | January, 2020 Chapter 7 Summary • Comparing common attacks • Summarizing secure coding concepts • Identifying application attacks • Understanding frameworks and guides
Editor's Notes
- A SYN flood is a form of denial-of-service attack in which an attacker sends a succession of SYN requests to a target's system in an attempt to consume enough server resources to make the system unresponsive to legitimate traffic. Essentially, with SYN flood DDoS, the offender sends TCP connection requests faster than the targeted machine can process them, causing network saturation. In a SYN flood attack, the attacker sends repeated SYN packets to every port on the targeted server, often using a fake IP address. The server, unaware of the attack, receives multiple, apparently legitimate requests to establish communication. It responds to each attempt with a SYN-ACK packet from each open port.
- Address Resolution Protocol (ARP) poisoning is when an attacker sends falsified ARP messages over a local area network (LAN) to link an attacker’s MAC address with the IP address of a legitimate computer or server on the network. Once the attacker’s MAC address is linked to an authentic IP address, the attacker can receive any messages directed to the legitimate MAC address
- DNS cache poisoning, also known as DNS spoofing, is a type of attack that exploits vulnerabilities in the domain name system (DNS) to divert Internet traffic away from legitimate servers and towards fake ones. The Internet doesn’t just have a single DNS server, as that would be extremely inefficient. Your Internet service provider runs its own DNS servers, which cache information from other DNS servers. Your home router functions as a DNS server, which caches information from your ISP’s DNS servers. A DNS cache can become poisoned if it contains an incorrect entry. For example, if an attacker gets control of a DNS server and changes some of the information on it — for example, they could say that google.com actually points to an IP address the attacker owns — that DNS server would tell its users to look for Google.com at the wrong address. The attacker’s address could contain some sort of malicious phishing website Pharming is a cyber attack intended to redirect a website's traffic to another, fake site. DNS amplification attack. DNS amplification is a Distributed Denial of Service (DDoS) attack in which the attacker exploits vulnerabilities in domain name system (DNS) servers to turn initially small queries into much larger payloads, which are used to bring down the victim's servers.
- A Smurf attack scenario can be broken down as follows: Smurf malware is used to generate a fake Echo request containing a spoofed source IP, which is actually the target server address. The request is sent to an intermediate IP broadcast network. The request is transmitted to all of the network hosts on the network. Each host sends an ICMP response to the spoofed source address. With enough ICMP responses forwarded, the target server is brought down.
- Microsoft LAN Manager (LM) NT (New Technology) LAN Manager (NTLM) Use NTMLv2 instead A birthday attack is a name used to refer to a class of brute-force attacks. It gets its name from the surprising result that the probability that two or more people in a group of 23 share the same birthday is greater than 1/2; such a result is called a birthday paradox. Birthday attacks are often used to find collisions of hash functions. Hash collision occurs when the hashing algorithm creates same hash from different passwords. A rainbow table attack is a type of hacking wherein the perpetrator tries to use a rainbow hash table to crack the passwords stored in a database system. A rainbow table is a hash function used in cryptography for storing important data such as passwords in a database
- During replay attacks the intruder sends to the victim the same message as was already used in the victim's communication. The message is correctly encrypted, so its receiver may treat is as a correct request and take actions desired by the intruder. The attacker might either have eavesdropped a message between two sides before or he may know the message format from his previous communication with one of the sides. This message may contain some kind of the secret key and be used for authentication
- Clickjacking is an attack that tricks a user into clicking a webpage element which is invisible or disguised as another element.
- Man-in-the-browser is a form of man-in-the-middle attack where an attacker is able to insert himself into the communications channel between two trusting parties by compromising a Web browser used by one of the parties, for the purpose of eavesdropping, data theft and/or session tampering. Device drivers allow an operating system such as Windows to talk to hardware devices such as printers, keyboard, mouse. Sophisticated attackers may dive deep into device drivers and manipulate them so that they undermine the security on your computer. They could also take control of the audio and video of the computer, stop your anti-virus software from running, or your data could be exposed to someone else. Shimming: A shim is a small library that is created to intercept API (Application Program Interface) calls transparently and do one of three things: handle the operation itself; change the arguments passed; or redirect the request elsewhere. Refactoring: A set of techniques used to identify the flow and then modify the internal structure of code without changing the code’s visible behavior
- A memory leak is the gradual loss of available computer memory when a program (an application or part of the operating system) repeatedly fails to return memory that it has obtained for temporary use An Integer Overflow is the condition that occurs when the result of an arithmetic operation, such as multiplication or addition, exceeds the maximum size of the integer type used to store it.
- A buffer overflow occurs when a program or process attempts to write more data to a fixed length block of memory,.
- Compiled code are converted directly into machine code that the processor can execute. As a result, they tend to be faster and more efficient to execute than interpreted languages. They also give the developer more control over hardware aspects, like memory management and CPU usage Examples of pure compiled languages are C, C++, Erlang, Haskell, Rust, and Go Compiled code is the output of a compiler. Run-time code: Interpreters will run through a program line by line and execute each command. Interpreted languages were once known to be significantly slower than compiled languages Examples of common interpreted languages are HMTL, PHP, Ruby, Python, and JavaScript.
- Static code analysis is a method of debugging by examining source code before a program is run. It’s done by analyzing a set of code against a set (or multiple sets) of coding rules. Dynamic analysis identifies defects after you run a program (e.g., during unit testing). However, some coding errors might not surface during unit testing. So, there are defects that dynamic testing might miss that static code analysis can find. Both types of analysis detect defects. The big difference is where they find defects in the development lifecycle. Static code checking addresses problems early on and it pinpoints exactly where the error is in the code. STRESS TESTING is a type of Software Testing that verifies the stability & reliability of the system. This test mainly measures the system on its robustness and error handling capabilities under extremely heavy load conditions Sandboxing: Application sandboxing, also called application containerization, is an approach to software development and mobile application management (MAM) that limits the environments in which certain code can execute. The goal of sandboxing is to improve security by isolating an application to prevent outside malware, intruders, system resources or other applications from interacting with the protected app model verification The process of demonstrating that a model works as intended is referred to in simulation literature as model verification. It is much easier to debug a model built in stages and with minimal detail than to debug a large and complex model.
- Waterfall approach is a sequential model where the output of each phase acts as the input for the following phase, allowing the process to move downstream (like a waterfall). Agile approach to software development covers an array of SDLC styles, but the overarching theme is the same, this category is more adaptable and gives developers time to work while requirements are changing. Waterfall Pros: Easy to Understand Provides Structure Milestones are well understood Requirements stability Easy time management Cons: All requirements must be known from start Low level of flexibility Provides little transparency for end-users Agile Pros: Flexibility to make changes to requirements Testing is integrated from start to finish Increased speed to market Improved Risk Management Cons: Projects can run longer than anticipated Requires high level commitment of time and energy from developers