1. Comparison of Network Attacks COSC 356 Kyler Rhoades

2. Two classes of Network Attacks ◦Passive ◦Active

3. Passive ◦Non-evasive monitoring of transmissions ◦Traffic Analysis ◦Tricky to detect because data is unaffected

4. Active ◦Attacker tries to bypass or break into a secured system ◦Results in the disclosure or dissemination of data

5. Sniffing (Passive) ◦AKA  Eavesdropping  Mapping

6. Sniffing ◦Goals  Intercept information traveling throughout a network  To gather information about a network

7. Sniffing ◦How It Works  Attacker gains access to a network path  “Listen” to the data being transmitted back and forth ◦ Plaintext format ◦ E-mail messages, User names, Passwords, Documents

8. Sniffing

9. ◦How To Combat Sniffing  Strong encryption methods ◦ Key-agreement protocol  Don’t use passive HUBS

10. Spoofing (Active) ◦Impersonates another host ◦IP Spoofing  Trusted Source

11. Spoofing ◦Goals  Impersonate ◦ Malicious actions, if caught, will look as if another legitimate user was behind the attack

12. Spoofing ◦How It Works  Find an IP address of a host connected to a secure network  Fakes his IP address to that the known host  Any data transmitted will appear to becoming from the known host

13. Spoofing

14. ◦Attacks can also set up a spoofed access point  Legitimate users will think they are connected to their network  Attacker can easily monitor traffic and attack the connected hosts

15. Man-In-The-Middle Attack (Active) ◦Weakness in the TCP/IP protocol  Headers ◦Relies on spoofing

16. Man-In-The-Middle Attack ◦How It Works  An attacker makes connections between two victims and controls the relay between them ◦ Victims appear that they are on a private connection ◦ Attacker must be able to impersonate both victims  The attacker intercepts all the data transferred between the victims  The attacker then can take the data and manipulate it and send it to the recipient

17. Man-In-The-Middle Attack

18. ◦Defense  Strong mutual authentication protocols ◦ Key-agreement protocol

19. Denial of Service Attacks (DoS) (Active) ◦Aims to prevent the normal use of a network or device by legitimate users  Consume computational resources ◦ Bandwidth ◦ Disk Space ◦ CPU Time

20. Denial of Service Attacks (DoS) ◦How It Works  Buffer overflow attack ◦ Sends more traffic to a network address then the expected size of a given buffer. ◦ This can range from sending oversized internet control message protocol packets to as simple as sending emails that contain attachments with over 256 character file names.

21. Denial of Service Attacks (DoS) ◦Smurfing attack  Sends an IP ping request to a site that tells it to send the number of hosts in a site’s local network  The request appears to be sent from the target host  The result is that a large number of ping replies flooding back to the target host with the intention that the host will not be able to tell between real and fake traffic.

22. Smurfing Attack

23. Denial of Service Attacks (DoS) ◦SYN Floods  When a computer wants to make a TCP/IP connection to another computer, there is an exchange of TCP/SYN and TCP/ACK packets.  The computer that is trying to connect will send a TCP/SYN packet to the client requesting to connect. The client will return a TCP/ACK packet telling the computer it is allowed to connect.  The client then reserves a space for the incoming connection and waits for the computer to respond with another TCP/ACK packet.  The address of the computer requesting a connection is spoofed and when the client sends the TCP/ACK packet it is never received by a device or is simply ignored. If you do this multiple times to a given client, you will take up all the reserved connections for unresolved hosts and other legitimate hosts will not be able to connection to the client.

24. SYN Floods

25. Distributed Denial of Service Attacks (DDoS) (Active) ◦Multiple attackers flood the resources and bandwidth of a target host. ◦This is done by gaining control over many other hosts first and then installing a slave program. ◦The master program, controlled by the attacker, will contact the slave programs on all the different hosts to coordinate a denial of service attack on a target host.

26. Distributed Denial of Service Attacks (DDoS)