Attacking What We Do

A gratuitous ARP is an unsolicited ARP reply. Normally a device sends one when it boots. The weakness is that other hosts store whatever it claims, so any host can claim any IP/MAC pair.

ARP poisoning abuses this to build a man-in-the-middle (MiTM). The attacker sends spoofed replies that put the attacker's MAC address on the gateway's IP. Both sides then send their traffic to the attacker.

• —The victim's cache maps the gateway to the attacker's MAC.
• —The router's cache maps the victim to the attacker's MAC.
• —Passive poisoning steals information.
• —Active poisoning modifies or injects data.

Tools used for ARP poisoning include dsniff, Cain & Abel, ettercap and Yersinia.

DNS attacks fall into four categories: open resolver, stealth, domain shadowing and tunneling.

An open resolver is a DNS server that answers anyone, including hosts from outside its own domain. That exposes it to three kinds of abuse.

Cache poisoning

Spoofed records redirect users.

Amplification and reflection

A DoS attack with the target as the apparent source.

Resource utilisation

The attacker consumes the resolver until it restarts.

Stealth techniques hide where a malicious server really is. There are three:

Fast Flux

IP addresses change within minutes, behind compromised hosts.

Double IP Flux

Changes the IP mapping and also the authoritative name server.

DGA (Domain Generation Algorithm)

Malware generates random domains to use as C&C rendezvous points.

Domain shadowing means stealing the domain account, then quietly adding malicious subdomains that point to malicious servers. The real owner is never alerted.

DNS tunneling hides non-DNS traffic inside DNS records. The attacker alters the record types used (TXT, MX, SRV, NULL, A, CNAME) so the traffic looks like ordinary DNS.

1. 1.Data is split into encoded chunks placed in subdomain labels.
2. 2.The queries reach the attacker's authoritative name server.
3. 3.The replies carry encoded commands back.
4. 4.Malware recombines and executes them.

The defence is to inspect DNS traffic. Watch for queries longer than average and for suspicious domain names. Use Cisco Umbrella or a similar service, and treat Dynamic DNS domains as highly suspect.

A DHCP client gets its configuration through a four-message exchange:

A rogue DHCP server exploits the fact that the client accepts whichever offer arrives first. It can hand out:

• —A wrong gateway, giving a MiTM that is often undetected.
• —A wrong DNS server, sending users to malicious websites.
• —A wrong IP address, causing a DoS.

A typical web attack runs in stages:

1. 1.The victim visits a compromised page.
2. 2.The browser is redirected through servers to malicious code.
3. 3.A drive-by download begins: an exploit kit scans the OS, Java and Flash.
4. 4.The kit fetches code for the vulnerability it found.
5. 5.The machine downloads a payload and the malware runs.

HTTP status codes are grouped by their first digit:

Two techniques hide the attack in plain sight. A malicious iFrame is a few invisible pixels that load the attacker's page inside a real one; an iFrame loads another page from another source and can deliver spam ads, exploit kits and malware. HTTP 302 cushioning chains legitimate redirects until the browser lands on the exploit. It abuses the 302 Found response and its location field, and is hard to detect because legitimate redirects are everywhere.

Countermeasures to web attacks: patch the OS and browsers, use a web proxy (Cisco Cloud Web Security or WSA), follow OWASP best practice (its Top 10 lists common risks) and educate end users. Against iFrames specifically, use a web proxy, avoid iFrames in your own code, use Cisco Umbrella and teach users what an iFrame is.

There are five email threats:

Attachment-based

Malicious content hidden in business files.

Email spoofing

A forged sender address.

Spam

A reply confirms the address is live.

Open mail relay

A misconfigured SMTP server that anyone can send through.

Homoglyphs

Look-alike characters (O vs 0, l vs 1): identical to a person, different in DNS.

Code injection and SQL injection both exist because input isn't validated. Code injection runs commands on the server OS with the app's permissions. SQL injection runs database queries: it can read, modify or destroy data, and sometimes reach the OS.

Best practice for defending a network can be remembered as policy, people, physical, passwords, patching and proof:

• —A written security policy.
• —Educate employees on social engineering.
• —Control physical access.
• —Use strong passwords and change them often.
• —Encrypt sensitive data.
• —Deploy firewalls, IPS, VPN, antivirus and content filtering.
• —Take backups, and test them.
• —Shut down unnecessary services and ports.
• —Patch weekly or daily.
• —Run security audits.

Antivirus is host-based: it is installed on computers and servers, not the perimeter, so it doesn't stop malware entering the network. Its definitions must update automatically or on demand. Perimeter devices strip known malware by its IOCs, but actors alter malware to evade detection. No technique is 100% effective.

Worm mitigation has four phases, in this order:

Reconnaissance is mitigated with authentication, encryption (which makes packet sniffing useless), anti-sniffer tools that spot hosts handling too much traffic, a switched infrastructure, and a firewall and IPS to limit what a port scanner learns. Ping sweeps stop if ICMP echo is off, but you lose diagnostics.

Access attacks are mitigated with passwords of 8+ characters (upper, lower, numbers, special), disabling accounts after failed logins, the principle of minimum trust between systems, cryptography for remote access and routing traffic, and multifactor authentication (codes or one-time tokens). Detect them by reviewing logs, bandwidth and process loads.

DoS often shows first as complaints: slow performance and unavailable resources. Run network utilisation software continuously and use network behaviour analysis to spot unusual patterns. The defence is antispoofing: port security, DHCP snooping, IP Source Guard, DAI and ACLs.