Cybersecurity Fundamentals Quiz

Local DNS Attack

• DNS poisoning or cache poisoning redirects traffic from a legitimate website to a malicious one
• Carried out within a local network
• Steps of execution:
  • Compromise: Attacker gains access to local DNS servers
  • Cache Poisoning: Attacker injects false DNS records into the cache
  • Redirection: User's legitimate request triggers a DNS request which is intercepted
  • Traffic Diversion: User receives malicious IP and the traffic is redirected to the compromised website
  • Attack Execution: User is redirected to a malicious website, potentially allowing data theft, malware distribution, phishing, etc.

Remote DNS Attack

• Similar end goal to local DNS attacks, but the process differs significantly.
• Attacker is outside the internal network.
• DNS queries and other traffic packets cannot be sniffed by the attacker.
• This makes the attack much more difficult.
• Challenges: Spoofing DNS replies is more complex for attackers who are not on the same network as the local DNS server.

Why DNS Attacks Are Difficult

• Attackers cannot directly see DNS queries
• They must guess two key values:
  • Source Port Number (16-bit random number)
  • Transaction ID (16-bit random number)
• The probability of guessing both values correctly is 1 in 2³² for each attempt.
• A single attacker needs approximately 50 days to exhaust all combinations if sending 1000 spoofed packets per second.
• Using a botnet with 1000 hosts reduces the time to approximately 1.2 hours.
• Key obstacles include timing of spoofing and cache effect.

Kaminsky Attack

• Dan Kaminsky developed a solution by addressing a caching effect vulnerability.
• It allowed continuous spoofing attacks without cache expiration
• Kaminsky's solution involves not triggering the DNS server to send out a query for the hostname.
• This prevents the cache from storing the answer in the case of failure, saving the attacker from waiting for timeout.
• The alternative method looks away from the answer section to query the authoritative section instead.
• In an example of authoritative section targeting, in the authoritative part, there is information about the name servers, thus, any sub domain of it would point to the authoritative section, which the attacker could then spoof.
• This means the attacker can spoof a reply with the malicious name server and, thus, modify the response through the DNS response.

DNSSEC

• A set of extensions to DNS that strengthens authentication and ensures data integrity using digital signatures.
• Digital signatures: DNS data is signed by the data owner and all DNSSEC-protected zones return digitally signed answers.
• Chain of Trust: Validates DNS responses by verifying signatures through a hierarchy of trusted zones.
• Example: If "example.com" is DNSSEC enabled, the resolver retrieves the zone's public key, verifies the signature on the DNS data then if valid, the resolver considers the response authentic.
• Benefits: Prevents DNS poisoning by rejecting forged data and protects against attackers injecting false records.

TLS/SSL

• Used for secure communication between a client and a server
• Encrypts data in transit
• Prevents man-in-the-middle attacks
• Uses public key encryption for secure communication.
• Establishes a connection with a handshake request
• The server provides its certificate signed by a trusted CA
• The client verifies the certificate, and an encrypted session is established.

Firewalls

• Security systems monitoring incoming and outgoing traffic to prevent unauthorized access.
• Firewall decisions based on rules (firewall policy or ruleset) to specify criteria of packet behavior for actions of accepting, discarding, etc.
• Source and destination IP address, ports, and protocol are examples of factors analyzed.
• Various actions possible dependent on the rule, like accept, deny, drop, or rejected.
• Types of firewalls
  • Network-based: Placed in-path on the network for protection of multiple devices independently from hardware devices.
  • Host-based: Works on the individual device before interacting with applications on the host.
  • Demilitarized Zone (DMZ)-A small, isolated network between the internet and private network containing web services like web servers, mail servers, and FTP servers.

Stateful vs. Stateless Firewalls

• Stateless firewalls inspect each packet independently without considering the context of previous packets.
• Stateful firewalls track the state of network connections to analyze each packet based on the connection.

Application/Proxy Firewalls

• Inspect packet headers and application data for malicious content to block or allow traffic based on security criteria.

Next-Generation Firewalls (NGFWs)

• Combines multiple security features into one single device.
• Functions:
  • Deep packet inspection (DPI): Analyzes the content of network traffic to identify malicious payloads and suspicious activity.
  • Application awareness: Identifies and controls specific applications.
  • Intrusion prevention system (IPS): Analyzes network traffic for malicious patterns and prevents attacks.
  • VPN functionality: Enables secure remote access to the network.
  • URL Filtering: Blocks access to malicious websites and unwanted content.

Network Address Translation (NAT)

• Technique to map one IP address space to another, conserving public IP addresses.
• NAT devices map internal IP addresses to a single public IP address.
• Basic NAT maps one-to-one, while NAPT maps multiple internal addresses to a single public address using different port numbers.
• Address pairing: NAT assigns the same public IP address to multiple connections initiated by the same internal host.

Intrusion Detection Systems (IDS)

• System which monitors and analyzes system/network events to detect suspicious activity.
• Can be used to monitor
  • Network traffic, system logs, file integrity, and system behavior
• Types
  • Host-based (HIDS): Monitors host activities
  • Network-based (NIDS): Monitors network traffic
• Approaches
  • Anomaly detection: Detect deviations from normal activity patterns
  • Signature detection: Matches patterns to database of known malicious activities.

Intrusion Prevention Systems (IPS), Host-Based Intrusion Prevention

• Proactive security technology that identifies, blocks, and prevents malicious activity in real time.

Honeypots

• Decoy systems or a virtual network that attracts attackers
• Used to gather intelligence on malicious activities and distract them from critical infrastructure.
• Types
  • Host traps
  • Network traps
  • Malware honeypots

Snort

• Open-source network intrusion detection system (IDS) and prevention system (IPS).
• Uses rules to detect and classify malicious activities.
• Offers options for capturing and logging data.

Port Forwarding

• Technique to route incoming traffic destined for a specific internal server to that specific server through a NAT device.
• Configure the public and private IP addresses and port information for routing to successfully forward traffic.

VPN

• Virtual private network: A secure tunnel between a computer inside a network to another outside a network.
• Encrypts data from the internal network, making it impossible for firewalls to filter or analyze data.