Introduction
By now you are aware of the different types of network attacks, but you might be asking yourself why and how exactly it’s done. Well, some of the methods are highly technical! And as technology advances, so does the sophistication of network attacks. It is essential to understand the technical aspects of common types of network attacks, the motives of the attackers, and the impact they can have. And that is precisely the focus of this reading.
Sniffing
You’ve learned that sniffing is part of eavesdropping and involves listening to the communication between two devices, intercepting it, capturing it and then analyzing it. This type of attack can steal your data from a distance, without even physically accessing your computer. The sniffing software just sits between the communication process, sees what’s coming and going and reads everything.
Sniffing procedures
Sniffing can be done with hardware or software. Hardware-based sniffing involves using specialized network devices, such as network taps or port mirroring on network switches, to capture network traffic. These devices are physically connected to the network and can capture data without being detected by the target system or network monitoring tools.
Software-based sniffing utilizes tools or applications installed on a computer to monitor and capture network traffic. These tools can run on the attacker’s device or, in some cases, run on the target system to capture data remotely. Some popular sniffing tools are Wireshark and Tcpdump.
Spoofing
You’ve learned that spoofing refers to a cyberattack where an attacker impersonates a legitimate user or device by falsifying the source information, such as an IP address or email. The main goal is to deceive the target system or user into believing that the attack comes from a trustworthy source. The image below indicates that during a spoof attack, a false request for data appears to come from a trusted source. The server is tricked into thinking the request is genuine and sends large amounts of data to the attacker.
Types of spoofing
There are many types of spoofing, here is a list.
IP spoofing: Attackers forge the source IP address in packets, making it appear as if they originate from a trusted IP address.
ARP spoofing: An attacker sends falsified Address Resolution Protocol (ARP) messages to associate their MAC address with the IP address of another device, intercepting the target’s network traffic.
DNS spoofing: By manipulating the Domain Name System (DNS), an attacker redirects users to false websites by providing a fake IP address associated with a legitimate domain name.
SSL/TLS spoofing: An attacker intercepts and alters SSL/TLS certificates, allowing them to eavesdrop on or modify encrypted communications between users and secure websites.
Spoofing procedures
Spoofing is done using specialized software or tools to modify packet headers, forge DNS responses, or craft ARP packets. This allows the attackers to intercept or redirect network traffic, bypass security controls, or gain unauthorized access to sensitive systems and data. In IP spoofing, for example, the attacker alters the source IP address in the IP packet header, making it appear as if the packet originates from a legitimate source. In DNS spoofing, the attacker provides a forged DNS response, directing the user to a malicious website. The primary goal of spoofing is to deceive network components or users, allowing the attacker to carry out various malicious activities while masquerading as a trusted entity. Tools like hping, scapy or Nmap are used to perform spoofing attacks.
Man-in-the-middle attack (MITM)
You also learned about a man-in-the-middle attack which is a form of network attack that involves sniffing and spoofing in which the attacker intercepts and may alter the communication between two parties without their knowledge. The goal of a MITM attack is often to eavesdrop on sensitive information or manipulate the communication to achieve a specific outcome. The diagram below demonstrates how a MITM attack works. The original connection between two network devices such as a user and a server is intercepted and replaced by new connection passing the MITM.
MITM procedures
To carry out a MITM attack, the attacker must first position themselves between the two communicating parties. This can be achieved through various techniques, such as ARP spoofing, DNS spoofing, or SSL/TLS hijacking. Once in the middle of the communication, the attacker can passively monitor the data being exchanged, modify it as needed, or even inject new data into the conversation, all while maintaining the appearance of a normal communication flow between the two parties. Ettercap is a package suite used for man-in-the-middle attacks and can execute both passive and active sniffing.
DoS & DDoS
You’ve also been introduced to DoS and DDoS attacks which aim to disrupt a target system or network, rendering it unavailable to its intended users. One of the key elements in executing DDoS attacks is the use of botnets, which are networks of compromised devices controlled by an attacker. The image below demonstrates how an attacker uses a network of bots to create traffic aimed at a victim.
Types of DoS and DDoS attacks
There are different types of DoS and DDoS attacks. They are:
- Volume-based attacks: Attackers flood the target system with excessive traffic, overwhelming its resources and bandwidth.
- Protocol attacks: Attackers exploit vulnerabilities in network protocols, causing server crashes or resource exhaustion.
- Application-layer attacks: Attackers target specific applications, exploiting vulnerabilities to consume system resources and disrupt service.
DoS and DDoS procedures
In volume-based attacks, the botnet is used to flood the target with a large amount of traffic, saturating its bandwidth and making it inaccessible to legitimate users. Protocol attacks exploit vulnerabilities in network protocols, causing the target system to become overwhelmed with requests and unable to process legitimate traffic. And application-layer attacks focus on specific applications or services running on the target system.
In a DDoS attack, the attacker leverages the combined resources of a botnet to generate a massive amount of traffic or requests directed towards the target system or network. Initially, attackers compromise many devices by exploiting vulnerabilities, social engineering, or distributing malware. Once the devices are infected, the attacker gains control over them and incorporates them into the botnet. Then, from a command-and-control control center, which is also called C&C, the attacker initiates the DDoS attack on the target system.
There are numerous freely available DDoS attack tools, including LOIC (Low Orbit ION Cannon), HOIC (High Orbit ION Cannon), Tor’s Hammer, and RUDY (R-U-Dead-Yet).
Wi-Fi password cracking
Lastly, let’s discuss password cracking, in specific Wi-Fi password cracking which is the process of deciphering a Wi-Fi network’s security key or passphrase to gain unauthorized access. The common intention of the attacker is to gain unauthorized access to the devices in the network, as well as avoiding detection by using the network to perform fraudulent activities.
Wi-Fi password procedures
Wi-Fi password cracking is done using various techniques, such as:
- Dictionary attack: The attacker uses a list of commonly used passwords or phrases to attempt to gain access to the network systematically.
- Brute force attack: The attacker systematically attempts all possible combinations of characters to crack the password. This method can be time-consuming and resource intensive.
- Rainbow table attack: The attacker uses precomputed tables of hashed password combinations (called rainbow tables) to quickly look up the plaintext password corresponding to a given hash. This method can be faster than brute force but requires significant storage resources. A password hash is a mathematically calculated encrypted version of your password.
Port scanning tools
Have you ever wondered how cybercriminals choose the best strategy to target weak spots in a network? Well, they do their homework by using port scanning tools to check for open ports in a network. And that gives them insight into the devices and processes happening on a network.
For example, say they find that port 21 is open, it means that there is an FTP server running. So, they initiate specific attacks aimed at FTP servers. Or, when they see port 22 is open, they can perform attacks to gain access to the SSH servers which use this particular port.
Conclusion
In this reading, you gained insight into the technical details behind common network attacks such as sniffing, spoofing, man-in-the-middle attacks, DoS, DDoS, and Wi-Fi password cracking. By exploring the methods and tools used in these attacks, you are better equipped to identify potential threats and vulnerabilities in networks.