Attack vectors i

1. Security Holes and Vulnerabilities in
Corporate network
- AMIYA DUTTA

2. In-General Corporate IT Infra 2

3. Critical Systems have two basic properties
1. Integrity
2. Availability
 Protecting a corporate network requires reduction the attack
surface
 Main attack-vector on a corporate network - User Computers
connected to the Internet on that network
 Its much easier to protect critical systems than workstations
3

4. Possible attack vectors that do not require any
administrator rights.
4

5. Local attacks
Attacker gets full access to the memory of all processes running under
the user account.
Attackers often use more secretive methods to bypass Antivirus
Detection
Domain attacks
Domain authentication mechanisms provide the user with access to
various network services on a corporate network.
Allows attackers to access all network folders and disks available to the
user, shared-internal-resources via the intranet and sometimes even
access other workstations on the same network segment.
5

6. Possible vectors for an attack launched on a corporate
network from an infected computer within it.
After gaining control over a user system in a corporate network,
subsequent events form three consecutive stages –
 Establishing foothold in the system
 Analysing the environment
 Propagating malware
6

7. 7

8. Gaining a Foothold in the System
 Attackers download utilities and malware to the victim computer
within a few hours or minutes.
 Utilities are required to collect information about the system and its
installed software, search for files and data, establish a connection
to the C&C, steal login credentials, brute-force passwords, escalate
privileges, infect a system, intercept network traffic, scan network
devices etc.
 Depending on the network configuration, firewall policies and
IDS/IPS settings, attackers might use direct or reverse connection.
8

9. Environment analysis
 Information about the operating system and its configuration,
updates installed for software, and security tools needs to be
collected
 Helps in selecting the most effective utilities and exploits
9

10. Propagation
 Launching malicious code from under a domain account belonging
to a user of an infected system
 using a keylogger and easily get hold of the login credentials to the
domain account as well as other services that do not maintain
domain authorization
 attempt to take advantage of vulnerabilities in the mechanisms for
storing and checking credentials, or brute-force the password
10

11. Top 5 Common Network Vulnerabilities
 Missing patches
 Weak or default passwords
 Misconfigured firewall rulebases
 Mobile devices
 USB Flash Drives
11

12. 12