This chapter is from the book
This chapter is from the book
This chapter is from the book
Network Attacks
Network attacks pose a significant threat to the security of an organization’s computer network. Threat actors will use various attacks that typically target systems such as routers, switches, servers, and other devices that data moves through. Let’s look at three types of attacks that can impact an organization. This is not an exhaustive list of attacks.
Distributed Denial-of-Service Attack
A distributed denial-of-service (DDoS) attack is a malicious and coordinated effort by a threat actor to overwhelm a system’s resources. This is achieved by flooding the system with a high volume of traffic. Unlike a typical denial-of-service (DoS) attack that only affects one system, a DDoS attack involves multiple systems within a computer network that are leveraged by the attacker. The main objective of a DDoS attack is to deny access to legitimate users, causing service disruptions and potentially damaging the reputation of the owner of the targeted system.
One common method employed in DDoS attacks is a botnet, consisting of a network of Internet-connected devices remotely controlled by the threat actor. These compromised devices enable the attacker to distribute the attack traffic across multiple sources, making mitigating and defending against the attack much more challenging. The following are common examples of DDoS attacks.
A synchronization (SYN) flood occurs when SYN requests are sent to a system but not responded to, creating half-open connections. SYN requests are the first part of the three-way handshake used to establish a connection with a system. By sending a large number of requests, resources are consumed while waiting for a response, preventing legitimate users from accessing that resource. We discuss the three-way handshake in Chapter 6, “Computer Networking Fundamentals.”
A User Datagram Protocol (UDP) flood is similar to a SYN flood but uses UDP packets to flood a system and exhaust the resources. UDP is a connectionless protocol that offers faster delivery but sacrifices reliability because it doesn’t require delivery confirmation. We discuss UDP in Chapter 6.
A Hypertext Transfer Protocol (HTTP) flood attacks web servers by sending HTTP Get and Post requests to the system to exhaust its resources. This application-based attack targets those systems at Layer 7 of the Open Systems Interconnection (OSI) model. We discuss the OSI model in Chapter 6.
Man-in-the-Middle Attack
A man-in-the-middle (MITM) attack occurs when a threat actor gains access to the communication channel between communicating parties and intercepts or alters the data, tricking victims into thinking they are communicating with each other. The attacker can now eavesdrop on sensitive information such as passwords, usernames, or financial data. MITM attacks are typically executed in places with insecure Wi-Fi, such as in coffee shops or hotels, and through spoofed websites. As a note, the phrase man-in-the-middle is now being replaced by “on path attack.”
Side-Channel Attack
A side-channel attack exploits information leaked unintentionally by a system’s physical implementation rather than a vulnerability in the software or an algorithm. By analyzing factors like power consumption or electromagnetic radiation, attackers can deduce sensitive data, such as passwords, without direct access, potentially compromising security measures. Side-channel attacks can occur in various contexts, including networks, and target specific devices or protocols. Protection against this type of attack can include limiting information in error and debugging log messages or using hardware-based security measures. For example, an attacker can intercept electromagnetic radiation emitted by a device during the process of entering a password. By analyzing variations in electromagnetic signals, such as those generated by keystrokes on a keyboard, the attacker can infer the sequence of characters being entered. This method allows the attacker to derive the password without directly accessing the device or obtaining it through traditional means.