Network Security Attacks and Defence

Network security

Network security involves the authorization of access to data in a network, which is controlled by the network administrator. Users choose or are assigned an ID and password or other authenticating information that allows them access to information and programs within their authority. Network security covers a variety of computer networks, both public and private, that are used in everyday jobs conducting transactions and communications among businesses, government agencies and individuals. Networks can be private, such as within a company, and others which might be open to public access. Network security is involved in organizations, enterprises, and other types of institutions. It does as its title explains: It secures the network, as well as protecting and overseeing operations being done. The most common and simple way of protecting a network resource is by assigning it a unique name and a corresponding password.

Types of attacks include:

Active

      1.  Denial-of-service attack (DoS)

      2.  Spoofing

      3.  Man in the middle

      4.  ARP poisoning

      5.  DNS Spoofing

      6.  Smurf attack

      7.  Buffer overflow

      8.  Heap overflow

      9.  Format string attack

      10.  SQL injection

      11. Cyber attack

 Passive

      1. Network

             a. Wiretapping

             b. Port scanner

             c. Idle scan

 

Denial-of-Service Attack (DoS)

 Denial of Service (DoS) attacks are among the most feared threats in today's cybersecurity landscape. Difficult to defend against and potentially costly, DoS attacks can cause outages of web sites and network services for organizations large and small. DoS attacks can also be lucrative for criminals, some of whom use these attacks to shake down businesses for anywhere from thousands to millions of dollars. 

DoS attack is used as a distraction to funnel attention and resources away while a targeted breach attack is being launched. Anonymous used that technique in a major 2011 attack that ultimately led to the theft of over 12 million customers' credit card data.

 DoS vs DDoS

The most easily executed type of DoS attack is one that is launched from a single origin. In this attack, a single machine somewhere on the Internet issues a barrage of network requests against a targeted victim machine. The requests themselves can take a variety of forms – for example, an  attack might use ICMP Flooding via ping requests, or HTTP requests against a web server.

In a DDoS attack, the incoming traffic flooding the victim originates from many different sources – potentially hundreds of thousands or more. This effectively makes it impossible to stop the attack simply by blocking a single IP address; plus, it is very difficult to distinguish legitimate user traffic from attack traffic when spread across so many points of origin.

How a Denial of Service Attack Works

The simple approach to DOS is to flood a server with a large amount of pointless traffic. This gives the server far too much to deal with. Bandwidth escalates, memory is exhausted and ordinary users can’t get a connection to the server.
But actually maxing out a server can be quite difficult, even with a large number of computers opening up as many connections as they can. As such, attackers have come up with a way to magnify the effect by using fake IP addresses.
Using fake IPs, the same process can be carried out by one computer, a botnet that’s controlled by one master or, as with Operation Payback, a group of people working together.
Here’s what happens.

1. The attacking machine sends a SYN packet to the server. However, it makes it appear to come from somewhere else.
2. The server then responds with a SYN/ACK packet, but there’s no response – the sender address was fake.
3. The server continues to wait for a reply, keeping the connection open and in its memory until it times out.

The server keeps a bunch of useless connections open, losing more and more memory to the attack and eventually becoming crippled.
The strategy is actually fairly successful. It has slowed or crashed some prominent sites.
However, companies have become wise to DDOS attacks and have begun to take some precautions.

Risks Associated with Denial of Service Attacks

Denial of Service attacks are centered around the concept that by overloading a target’s resources, the system will ultimately crash. In the case of a DoS attack against a web application, the software is overloaded by the attack and the application fails to serve web pages properly. To crash a web server running an application, a DoS threat attacks the following services:

• Network bandwidth
• Server memory
• Application exception handling mechanism
• CPU usage
• Hard disk space
• Database space
• Database connection pool

Can a DDoS be stopped ?

Let's start with the bad news: It is very difficult to defend against a sophisticated DDoS attack launched by a determined adversary.

There are several ways to defend against a DDOS attack. None can guarantee prevention, but the website owner does have options:

1. Filtering: Routers at the edge of the network can be trained to spot and drop DDOS connections, preventing them from slowing the network or the server.
2. Moving: If the attack is pointed at a specific IP address, the site’s IP can be changed. This is what the White House did before a nasty computer virus tried to DDOS its site.
3. Blackholing: A host may simply “blackhole” a site that is being DDOSed, directing all traffic to it to an address that doesn’t exist. This is normally a last resort.

In addition, many companies sell anti-DDOS applications that detect and block attacks.
The only sure-fire way to end a DDOS attack is to wait it out. Most attacks don’t last very long because those with botnets don’t wish to expose their network for too long, and group attacks can’t hold their cohesion forever. Though it may take a few days, the attack will cease of its own accord.
 

Spoofing

A spoofing attack is when a malicious party impersonates another device or user on a network in order to launch attacks against network hosts, steal data, spread maleware or bypass access controls. There are several different types of spoofing attacks that malicious parties can use to accomplish this. Some of the most common methods include IP address spoofing attacks, ARP spoofing attacks and DNS server spoofing attacks.

ARP Spoofing/ Poisoning

 ARP Spoofing/ Poisoning is a technique whereby an attacker sends fake ("spoofed") Address Resolution Protocol (ARP) messages onto a Local Area Network. Generally, the aim is to associate the attacker's MAC address with the IP address of another host (such as the default gateway), causing any traffic meant for that IP address to be sent to the attacker instead.

ARP spoofing may allow an attacker to intercept data frames on a LAN, modify the traffic, or stop the traffic altogether. Often the attack is used as an opening for other attacks, such as denial of service, man in the middle, or session hijacking attacks.

The attack can only be used on networks that make use of the Address Resolution Protocol (ARP), and is limited to local network segments.

DNS Server Spoofing Attacks

The Domain Name System (DNS) is a system that associates domain names with IP addresses. Devices that connect to the internet or other private networks rely on the DNS for resolving URLs, email addresses and other human-readable domain names into their corresponding IP addresses. In a DNS server spoofing attack, a malicious party modifies the DNS server in order to reroute a specific domain name to a different IP address. In many cases, the new IP address will be for a server that is actually controlled by the attacker and contains files infected with malware. DNS server spoofing attacks are often used to spread computer worms and viruses.

Spoofing Attack Prevention and Mitigation

There are many tools and practices that organizations can employ to reduce the threat of spoofing attacks. Common measures that organizations can take for spoofing attack prevention include:

• Packet filtering: Packet filters inspect packets as they are transmitted across a network. Packet filters are useful in IP address spoofing attack prevention because they are capable of filtering out and blocking packets with conflicting source address information (packets from outside the network that show source addresses from inside the network and vice-versa).
• Avoid trust relationships: Organizations should develop protocols that rely on trust relationships as little as possible. It is significantly easier for attackers to run spoofing attacks when trust relationships are in place because trust relationships only use IP addresses for authentication.
• Use spoofing detection software: There are many programs available that help organizations detect spoofing attacks, particularly ARP spoofing. These programs work by inspecting and certifying data before it is transmitted and blocking data that appears to be spoofed.
• Use cryptographic network protocols: Transport Layer Security (TLS), Secure Shell (SSH), HTTP Secure (HTTPS) and other secure communications protocols bolster spoofing attack prevention efforts by encrypting data before it is sent and authenticating data as it is received.

Man in the Middle

In cryptography and computer security, the man-in-the-middle attack (often abbreviated to MITM, MitM, MIM, MiM or MITMA) requires an attacker to have the ability to both monitor and alter or inject messages into a communication channel. One example is active eavesdropping, in which the attacker makes independent connections with the victims and relays messages between them to make them believe they are talking directly to each other over a private connection, when in fact the entire conversation is controlled by the attacker. The attacker must be able to intercept all relevant messages passing between the two victims and inject new ones. This is straightforward in many circumstances; for example, an attacker within reception range of an unencrypted Wi-Fi wireless access point, can insert himself as a man-in-the-middle.

 As an attack that aims at circumventing mutual authentication, or lack thereof, a man-in-the-middle attack can succeed only when the attacker can impersonate each endpoint to their satisfaction as expected from the legitimate other end. Most cryptographic protocols include some form of endpoint authentication specifically to prevent MITM attacks. For example, TLS can authenticate one or both parties using a mutually trusted certification authority.

Smurf Attack

 The Smurf Attack is a distributed denial-of-service attack in which large numbers of Internet Control Message Protocol (ICMP) packets with the intended victim's spoofed source IP are broadcast to a computer network using an IP Broadcast address. Most devices on a network will, by default, respond to this by sending a reply to the source IP address. If the number of machines on the network that receive and respond to these packets is very large, the victim's computer will be flooded with traffic. This can slow down the victim's computer to the point where it becomes impossible to work on.

 Buffer Overflow

 In computer security and programming, a buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory. This is a special case of violation of memory safety.
Buffer overflows can be triggered by inputs that are designed to execute code, or alter the way the program operates. This may result in erratic program behavior, including memory access errors, incorrect results, a crash, or a breach of system security. Thus, they are the basis of many software vulnerabilities and can be maliciously exploited.

 Programming languages commonly associated with buffer overflows include C and C++, which provide no built-in protection against accessing or overwriting data in any part of memory and do not automatically check that data written to an array (the built-in buffer type) is within the boundaries of that array. Bounds checking can prevent buffer overflows.

Exploitation

1. Stack-based exploitation
2. Heap-based exploitation
3. Barriers to exploitation
4. Practicalities of exploitation

         => NOP sled technique,
         => The jump to address stored in a register technique

Protective Countermeasures

1. Choice of programming language
2. Use of safe libraries
3. Buffer overflow protection
4. Pointer protection
5. Executable space protection
6. Address space layout randomization
7. Deep packet inspection

 Heap Overflow 

 A heap overflow is a type of buffer overflow that occurs in the heap data area. Heap overflows are exploitable in a different manner to that of stack-based overflows. Memory on the heap is dynamically allocated by the application at run-time and typically contains program data. Exploitation is performed by corrupting this data in specific ways to cause the application to overwrite internal structures such as linked list pointers. The canonical heap overflow technique overwrites dynamic memory allocation linkage (such as malloc meta data) and uses the resulting pointer exchange to overwrite a program function pointer.

Format String Attack

Uncontrolled format string is a type of software vulnerability, discovered around 1999, that can be used in security exploits. Previously thought harmless, format string exploits can be used to crash a program or to execute harmful code. The problem stems from the use of unchecked user input as the format string parameter in certain C functions that perform formatting, such as “printf()”. A malicious user may use the “%s”  & “%x” format tokens, among others, to print data from the stack or possibly other locations in memory. One may also write arbitrary data to arbitrary locations using the “%n” format token, which commands “printf()” and similar functions to write the number of bytes formatted to an address stored on the stack.

SQL Injection

SQL injection is a code injection technique, used to attack data-driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker). SQL injection must exploit a security vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database.

In a 2012 study, security company Imperva observed that the average web application received 4 attack campaigns per month, and retailers received twice as many attacks as other industries.

Technical Implementations

1. Incorrectly filtered escape characters
2. Incorrect type handling
3. Blind SQL injection
4. Conditional responses
5. Second Order SQL Injection

Mitigation

1. Parameterized statements
2. Enforcement at the coding level
3. Escaping
4. Pattern check
5. Database permissions

 Cyber Attack

Cyber-attack is any type of offensive maneuver employed by individuals or whole organizations that targets computer information systems, infrastructures, computer networks, and/or personal computer devices by various means of malicious acts usually originating from an anonymous source that either steals, alters, or destroys a specified target by hacking into a susceptible system. These can be labelled as either a Cyber campaign, cyber-warfare or cyber-terrorism in different context. Cyber-attacks can range from installing spyware on a PC to attempts to destroy the infrastructure of entire nations. Cyber-attacks have become increasingly sophisticated and dangerous as the Stuxnet worm recently demonstrated.

 cyber attack prevention

• Never click on links in emails. If you do think the email is legitimate, whether from a third party retailer or primary retailer, go to the site and log on directly. Whatever notification or service offering was referenced in the email, if valid, will be available via regular log on.

• Never open the attachments. Typically, retailers will not send emails with attachments. If there is any doubt, contact the retailer directly and ask whether the email with the attachment was sent from them.

• Do not give out personal information over the phone or in an email unless completely sure. Social engineering is a process of deceiving individuals into providing personal information to seemingly trusted agents who turn out to be malicious actors. If contacted over the phone by someone claiming to be a retailer or collection agency, do not give out your personal information. Ask them to provide you their name and a call-back number. Just because they may have some of your information does not mean they are legitimate!

Other practical tips to protect yourself from cyber attacks:

• Set secure passwords and don't share them with anyone. Avoid using common words, phrases, or personal information and update regularly.
• Keep your operating system, browser, anti-virus and other critical software up to date. Security updates and patches are available for free from major companies.
• Verify the authenticity of requests from companies or individuals by contacting them directly. If you are asked to provide personal information via email, you can independently contact the company directly to verify this request.
• Pay close attention to website URLs. Pay attention to the URLs of websites you visit. Malicious websites sometimes use a variation in common spelling or a different domain (for example, .com instead of .net) to deceive unsuspecting computer users.
• For e-Mail, turn off the option to automatically download attachments.
• Be suspicious of unknown links or requests sent through email or text message. Do not click on unknown links or answer strange questions sent to your mobile device, regardless of who the sender appears to be.

Wiretapping

Telephone tapping (also wire tapping or wiretapping in American English) is the monitoring of telephone and Internet conversations by a third party, often by covert means. The wire tap received its name because, historically, the monitoring connection was an actual electrical tap on the telephone line. Legal wiretapping by a government agency is also called lawful interception. Passive wiretapping monitors or records the traffic, while active wiretapping alters or otherwise affects it.  

 Port scanner

A port scanner is a software application designed to probe a server or host for open ports. This is often used by administrators to verify security policies of their networks and by attackers to identify running services on a host with the view to compromise it.

A port scan or port scan can be defined as a process that sends client requests to a range of server port addresses on a host, with the goal of finding an active port. While not a nefarious process in and of itself, it is one used by hackers to probe target machine services with the aim of exploiting a known vulnerability of that service. However the majority of uses of a port scan are not attacks and are simple probes to determine services available on a remote machine.

To portsweep is to scan multiple hosts for a specific listening port. The latter is typically used to search for a specific service, for example, an SQL-based computer worm may portsweep looking for hosts listening on TCP port 1433.

Types

1. TCP scanning
2. SYN scanning
3. UDP scanning
4. ACK scanning
5. Window scanning
6. FIN scanning
7. Other scan types

 Idle Scan

The idle scan is a TCP port scan method that consists of sending spoofed packets to a computer to find out what services are available. This is accomplished by impersonating another computer called a "zombie" (that is not transmitting or receiving information) and observing the behavior of the ''zombie'' system.

 

Overall Defense against Network Attack

Configuration Management

The main weapon in network attack defense is tight configuration management. The following measures should be strictly implemented as part of configuration management.

• If the machines in your network should be running up-to-date copies of the operating system and they are immediately updated whenever a new service pack or patch is released.

• All your configuration files in your Operating Systems or Applications should have enough security.

• All the default passwords in your Operating Systems or Applications should be changed after the installation.

• You should implement tight security for root/Administrator passwords.
 

Firewalls

Another weapon for defense against network attack is Firewall. Firewall is a device and/or a sotware that stands between a local network and the Internet, and filters traffic that might be harmful. Firewalls can be classified in to four based on whether they filter at the IP packet level, at the TCP session level, at the application level or hybrid.

1. Packet Filtering: Packet filtering firewalls are functioning at the IP packet level. Packet filtering firewalls filters packets based on addresses and port number. Packet filtering firewalls can be used as a weapon in network attack defense against Denial of Service (DoS) attacks and IP Spoofing attacks.

2. Circuit Gateways: Circuit gateways firewalls operate at the transport layer, which means that they can reassemble, examine or block all the packets in a TCP or UDP connection. Circuit gateway firewalls can also Virtual Private Network (VPN) over the Internet by doing encryption from firewall to firewall.

3. Application Proxies: Application proxy-based firewalls function at the application level. At this level, you can block or control traffic generated by applications. Application Proxies can provide very comprehensive protection against a wide range of threats.

4. Hybrid: A hybrid firewall may consist of a pocket filtering combined with an application proxy firewall, or a circuit gateway combined with an application proxy firewall.
 

Encryption

Encryption is another great weapon used in defense against network attacks. Click the following link to get a basic idea of encryption.

Encryption can provide protection against eavesdropping and sniffer attacks. Private Key Infrastructure (PKI) Technologies, Internet Protocol Security (IPSec), and Virtual Private Networks (VPN) when implemented properly, can secure you network against network attacks.

Other tips for defense against network attack are

• Privilege escalation at different levels and strict password policies

• Tight physical security for all your machines, especially servers.

• Tight physical security and isolation for your back up data.