-: General network attacks. 2 2
In this lesson, we're going to discuss 3 3
some general network attacks that you may come across 4 4
while working in the field. 5 5
These attacks include things like on-path 6 6
or Man in the Middle attacks, 7 7
session hijacking, DNS poisoning and rogue DHCP servers. 8 8
Let's jump right into our first type of attack, 9 9
known as an on-path attack, 10 10
but you may be more familiar with it by another name, 11 11
the MITM or Man in the Middle attack. 12 12
Now, a Man in the Middle attack occurs when an attacker 13 13
puts themselves between the victim 14 14
and the intended destination. 15 15
For example, if you're trying to connect to yourbank.com 16 16
from your laptop, 17 17
and someone's able to get in between your laptop 18 18
and the bank servers, 19 19
this would be an on-path attack. 20 20
In this type of attack, 21 21
the attacker is simply going to have the ability 22 22
to monitor whenever you're sending, 23 23
or they can even manipulate it 24 24
because they're in the middle of the communications 25 25
between you and the server. 26 26
For example, let's pretend I have a client 27 27
who is client number 12345, 28 28
and they want to conduct a transaction at their online bank. 29 29
They go and they log on and they go to transfer $50 30 30
to their account. 31 31
Now they send a request to move $50 to account 12345 32 32
from their checking account 33 33
and they think that request 34 34
went straight to the bank servers for processing, 35 35
but little did they know they were in the middle 36 36
of a Man in the Middle attack or on-path attack. 37 37
So what happens? 38 38
Well from this position of the Man in the Middle 39 39
of the communication, 40 40
they're sitting between the client and the bank. 41 41
So the attacker can then change the amount from $50 42 42
to $5,000, or they could change the bank account 43 43
that funds are going to be transferred to. 44 44
So instead of going to account 12345, 45 45
it now goes to 67890 instead. 46 46
Now the bank servers still believe there's an authentication 47 47
that has happened between the client and the bank servers. 48 48
So they're going to process the requests 49 49
and instead they're going be sending 100 times the money 50 50
from the client's checking account 51 51
to the attacker's account, 52 52
as directed by this modified request they received. 53 53
Now another type of general network attack 54 54
is known as session hijacking. 55 55
Session hijacking occurs when an attacker 56 56
is able to guess the session ID that is in use 57 57
between a client and a server, 58 58
and then they could try to take over 59 59
that already authenticated session. 60 60
In this type of attack, 61 61
it's very similar to an on-path attack, 62 62
but instead of being placed into the middle 63 63
of the conversation and relaying the victim's request 64 64
to the server, 65 65
it instead focuses on taking over the session completely 66 66
and the victim's machine is no longer receiving 67 67
any of the data. 68 68
This type of attack is focused on exploiting the way 69 69
TCP/IP protocols are going to use session numbers 70 70
or session IDs at layer five of the OSI model. 71 71
In the early days of TCP/IP, 72 72
the session IDs were not randomly assigned, 73 73
but instead they were assigned in sequential order. 74 74
So if I had session ID 123, 75 75
I could probably guess that your next session 76 76
was going to be 124, 77 77
and if you create your session right before, 78 78
or right after me, I can then guess your ID as 122 or 124, 79 79
because it's one before or one after my particular session. 80 80
So to combat this, 81 81
session ID's now got to be randomized 82 82
inside our newer TCP/IP configurations. 83 83
So if I now have session 123, 84 84
you might have session 934, or 523 or anything else, really, 85 85
because it's going to be just randomly assigned to you 86 86
and that way I can't guess your session ID 87 87
and take over your session using session hijacking. 88 88
Next, we're going to discuss an attack known as DNS poisoning. 89 89
Now, DNS poisoning occurs when an attacker manipulates 90 90
known vulnerabilities within the domain name system, 91 91
or DNS, to reroute traffic from one site 92 92
to a fake version of that site. 93 93
DNS poisoning usually occurs on a company's internal DNS 94 94
servers instead of on the public facing DNS servers 95 95
used by most of us on the internet. 96 96
But in some cases, those internet DNS servers 97 97
have also been poisoned. 98 98
Remember DNS is used for one big thing. 99 99
It's to be able to provide a method of changing domain names 100 100
into IP addresses and vice versa. 101 101
When a client needs to go to a website 102 102
like diontraining.com, 103 103
they asked their DNS server for the location of that server, 104 104
and they receive an IP address back as the location 105 105
from that DNS server 106 106
and then their computer goes to the IP address 107 107
to load the website. 108 108
Now, since DNS works in a hierarchal manner, 109 109
the client assets local DNS servers 110 110
for the resolution of that domain first. 111 111
If the DNS server has the domain name 112 112
and IP address stored locally within its cache, 113 113
it's going to return that address to the client. 114 114
So what does an attacker do in DNS poisoning? 115 115
Well, they're going to attempt to change the IP address 116 116
of a domain name stored in the DNS cache 117 117
of a given DNS server. 118 118
If they can do that, any client who requests to visit 119 119
that website in the future 120 120
will be redirected to a website controlled by the attacker, 121 121
allowing them to conduct further exploitation 122 122
of your client, which is now their victim. 123 123
Remember, DNS poisoning works by poisoning 124 124
either a workstation or servers DNS cache, 125 125
hijacking their local DNS server 126 126
or performing an unauthorized zone transfer 127 127
to an unpatched DNS server to change the IP address 128 128
of a given web servers A record. 129 129
To counteract DNS poisoning attacks, 130 130
a secure version of DNS known as DNSSEC has been created. 131 131
DNSSEC uses encrypted digital signatures 132 132
when passing DNS information between servers 133 133
to help protect it from poisoning. 134 134
You can also prevent your DNS servers from being poisoned 135 135
by ensuring your server has the latest security patches 136 136
and the latest updates to make sure 137 137
they're always properly protected. 138 138
The next attack we're going to discuss 139 139
involves the use of rogue DHCP servers. 140 140
Now a rogue DHCP server is any DHCP server 141 141
that is connected to your network, 142 142
but you as the network administrator 143 143
did not have control over and did not install it. 144 144
This usually happens when an attacker or an end user 145 145
connects their own DHCP server to your network, 146 146
and often it's unintentionally done by your own users. 147 147
When that rogue DHCP servers connected to the network, 148 148
it's going to do what DHCP servers do 149 149
and it's going to start assigning IPs to clients 150 150
on the network when they boot up 151 151
and reconnect to the network. 152 152
Now, the issue here is that these rogue DHCP servers 153 153
are now handing out IP addresses, subnet masks, gateways, 154 154
and DNS server assignments to your network clients. 155 155
In the best case, 156 156
these rogue DHCP servers are simply going to be connected 157 157
by one of your end users 158 158
because they wanted to add a wireless access point 159 159
to their office and so they ran down 160 160
to the local electronics store and they bought themselves 161 161
a wireless router or gateway. 162 162
Little did they know these devices include a DHCP server 163 163
that's turned on by default. 164 164
So when they connected it to the network, 165 165
it began its job as handing out DHCP server addresses. 166 166
This can lead to clients that have the same IP address 167 167
as other clients in the network because this DHCP server 168 168
is rogue and it doesn't know what addresses 169 169
your official DHCP server was already using 170 170
inside that same scope. 171 171
This is especially popular inside private class C addresses 172 172
of 192.168.1.0/24. 173 173
And this can lead to two clients having connectivity issues 174 174
on the network because they both have the same IP address. 175 175
Now, in the worst case, 176 176
this rogue DHCP server was actually attached to your network 177 177
by an attacker. 178 178
The attacker could then issue out IP addresses 179 179
and subnet mask that will properly connect to your network. 180 180
But these rogue DHCP servers can also be used 181 181
to configure clients to use a gateway 182 182
that the attacker controls, 183 183
and this would allow them to do an on-path attack 184 184
and intercept or modify communications 185 185
between the clients and the outside servers. 186 186
This essentially becomes an on-path 187 187
or Man in the Middle attack. 188 188
These rogue DHCP servers can also assign 189 189
a different DNS server for the clients to use. 190 190
This can effectively create the same effect as DNS poisoning 191 191
from the client's perspective. 192 192
So you want to be wary of these rogue DHCP servers, 193 193
and always look for them on your network 194 194
and when you find them, get them off the network. 195 195
(static whooshing)