Untitled

• The session discusses application and networking-based attacks in cyber security.
• Instructor will spend 2 - 2.30 hours for the slides, leaving 1.30 - 2.00 hours including submission for lab work.

Application Attacks

• Attacks on networked computer system applications can target the server, client, or both

Server-Side Web Application Attacks

• Securing server-side web applications is often more difficult than securing other systems
• Traditional network security devices cannot always block web application attacks.
  • Many network security devices ignore the HTTP traffic content.
• Zero-day attack exploits previously unknown vulnerabilities.
  • Victims have little time to prepare for or defend against it.
• Many attacks target input that applications accept from users.
• Common web application attacks are:
  • Cross-site scripting
  • SQL injection
  • XML injection.

Cross-Site Scripting (XSS)

• XSS involves injecting scripts into a Web application server to target clients.
• When a victim visits an injected website
  • Malicious instructions are sent to their browser.
• Some XSS attacks are designed to steal information retained by the browser.
• An XSS attack requires that a website:
  • Accepts user input without validation.
  • Uses this input in a response.

Types of Cross-Site Scripting (XSS)

• Reflected (Non-persistent)
  • Script is executed on the victim side.
  • Script is not stored on the server.
• Stored XSS (Persistent)
  • Script is stored and executed on the server.
  • Executed every time the malicious site is requested
• DOM (Document Object Model) XSS
  • Client side attack, the script is not sent to the server.
  • Legitimate server script is executed, followed by a malicious script

SQL Injection

• SQL injection targets SQL servers by injecting malicious commands.
• SQL (Structured Query Language) is used to manipulate data in relational databases.
• Example: Attacker enters incorrectly formatted email address in a “forgotten password” field.
  • The response from the website lets the attacker know whether the input is being validated.
• Attackers enter statements, which are then processed by the database.
  • SELECT fieldlist FROM table WHERE field = 'whatever' or 'a'='a'
  • This will display all user email addresses

SQL Injection Statement Examples

• whatever' AND email IS NULL; -- Result = Determine names of different fields.
• whatever' AND 1=(SELECT COUNT(*) FROM tabname); -- Result = Discover the table name.
• whatever' OR full_name LIKE '%Mia% Result = Find specific users.
• whatever'; DROP TABLE members; -- Result = Erase the database table.
• whatever'; UPDATE members SET email = '[email protected]' WHERE email = '[email protected]'; Result = Mail password to attacker's email account.

XML Injection

• XML injection attacks are similar to SQL injection attacks
• The attacker discovers a Web site that does not filter user data and injects XML tags and data into the database.
• XPath injection is a specific type of XML injection attack that exploits XML Path Language queries built from user input.

Client Side Attacks

• Web application attacks are server-side attacks.
• Client-side attacks target vulnerabilities in client applications
• Client applications interact with a compromised server and/or process malicious data.
• The client initiates a connection with the server:
  • Which could result in an attack

Drive-by download

• Client computer is compromised simply by viewing a Web page
• Attackers inject content into vulnerable web servers.
  • gaining access to the server's operating system.
• Attackers craft zero-pixel iFrames (inline frames) to avoid visual detection.
• Code is embedded within the HTML main document.
• The client's browser downloads malicious script and computer downloads malware

HTTP Header manipulation

• HTTP header contains fields that characterize data being transmitted.
• Headers can originate from a Web browser.
  • Browsers do not normally allow this.
  • An attacker's short program can allow modification

HTTP Header Manipulation Examples

• Referer field: can be modified by the attacker to hide the fact it came from another side.
• Accept-language field: Attacker could inject a SQL command to modify this header.
• Response splitting: one of the most common header manipulation attacks

Cookies

• Cookies store user-specific information on the user's local computer.
• First-party cookie: created by the website the user is viewing
• Third-party cookie: site advertisers place a cookie to record user preferences
• Session cookie: stored in RAM and expires when the browser is closed.
• Persistent cookie: recorded on the computer's hard drive and does not expire when the browser closes, also called tracking cookies.
• Locally Shared Object (LSO): can store up to 100 KB of data, more complex than cookies, also called Flash cookies.
• Security & privacy risks
  • First-party cookies may be stolen and used to impersonate the user.
  • Used to tailor advertising and can be exploited by attackers

Attachments

• Files are coupled with email messages.
• Malicious attachments are commonly used to spread viruses, Trojans, and other malware.

Session Hijacking

• An attacker attempts to impersonate a user by stealing/guessing the session token
• A session token is a random string assigned to an interaction between a user and a web application
• Attacker can attempt to obtain the session token by:
  • By using XSS or other attacks
  • Eavesdropping on the transmission
  • Guessing the session token

Malicious Add-ons

A plugin is a third party library that attaches to the web browser, and is embedded in a webpage.

• Add-ons/extensions add functionality to the web browser.
• Add-ons can:
  • Create web browser toolbars.
  • Change browser menus.
  • Be aware of other tabs open in the same browser.
  • Process loaded web page content.

Add-On Security Risks

• Attackers create malicious add-ons targeting a user's computer.
• Malicious add-ons can be written in Microsoft's ActiveX.
  • ActiveX is a rules set for how applications under the Microsoft Windows OS should share info.
• Vulnerabilities in ActiveX can be exploited by attacker, to perform malicious attacks on a computer

Networking-Based Attacks

• Attackers place a high priority on targeting networks.
  • Exploiting a single vulnerability may expose hundreds/thousands of devices to an attacker.
• Types of networking-based attacks:
  • Denial of Service (DoS)
  • Interception
  • Poisoning
  • Attacks on access rights

Denial of Service (DoS)

• DoS: A deliberate attempt to overwhelm a system, preventing authorized users from accessing it.
• Most DoS attacks today are Distributed Denial of Service (DDoS).
  • Using hundreds/thousands of zombie computers in a botnet to flood a device with requests.

Ping Flood Attack

• Uses the 'ping' utility to send a large number of ICMP echo request messages.
• In a ping flood attack, multiple computers rapidly send a large number of ICMP echo requests.
  • The server drops legitimate connections and refuses new connections.

Smurf Attack

• Tricks devices into responding to false requests to an unsuspecting victim.
• Attacker broadcasts a ping request to all computers.
  • Address of the request is changed (called spoofing).
• It appears as if the victim's computer is asking for a response from all network computers.
• All computers send a response to the victim's computer causing it to be overwhelmed and crash, thus becoming unavailable to legitimate users.

SYN Flood Attack

• Takes advantage of procedures for initiating a session.
• In a SYN flood attack against a web server:
  • An attacker sends SYN segments in IP packets.
  • Attacker modifies the source address to unreachable computer addresses.

Interception

• Interception attacks are designed to intercept network communications.
• Man-in-the-Middle. Involves:
  • Interception of legitimate communication
  • Forging a fictitious response to the sender.
  • Two computers are sending and receiving data
  • A computer sits between them.
• Two types of attacks exist:
  • Passive - data is captured and recorded before sending onward to the original recipient.
  • Active - contents of the transmission are altered before they reach the recipient.

Replay attack

• Attacker copies a transmission before sending it to the original recipient and can:
  • Use copy at a later time
  • Example of capturing logon credentials
• More sophisticated replay attacks:
  • Attacker captures a network device's message to a server.
  • The attacker later sends the original, valid message to the server.
  • Establishing a trust relationship between the attacker and the sever

Poisoning

• Introducing a substance to harm a system.
• Attacks inject "poison" into a normal network process to facilitate an attack.
  • ARP poisoning
  • DNS poisoning

ARP Poisoning

• The attacker modifies the MAC address in the ARP cache to redirect to a different computer
• Attacks from ARP Poisoning:
  • Steal data by substituting her MAC address and steal data intended for another device.
  • Prevent Internet access by substituting an invalid MAC address for the network gateway.
  • Man-in-the-middle the device is set receive all communications by substituting her MAC address
  • DoS attack the valid IP address is substituted for an invalid MAC address.

DNS Poisoning

• The current basis for name resolution to IP address is the Domain Name System.
• DNS poisoning substitutes DNS addresses to redirect a computer to another device.
• Two locations for DNS poisoning:
  • Local host table
  • External DNS server

Session 3 Summary

• Web application flaws are exploited through normal communication channels.
  • Makes web apps more difficult to protect.
• Cross-site scripting (XSS) uses web sites that accept user input without validating it:
  • The uses the server to launch attacks on computers that access it.
• Client side attacks target vulnerabilities in client applications.
  • A client interacts with a compromised server.
• Session hijacking occurs when an attacker steals a session token and impersonates user.
• Buffer overflow attempts to compromise a computer by pushing data into inappropriate memory locations.
• DoS attempts to overwhelm a system so it cannot perform normal functions.
• In ARP and DNS poisoning valid addresses are replaced with fraudulent addresses.
• Access rights and privileges may also be exploited.