Network Attacks and Hackers

• This lecture introduces hackers, network attacks, and the basics of Linux

Systems and Network Security

• Systems and networks are vulnerable to a variety of attacks
• External vs Internal attacks
• Informational attacks involve stealing, modifying, and/or deleting data or holding it for ransom
• Denial of Service and Distributed Denial of Service attacks
• Infrastructure attacks

Network Security Challenge

• Network security is challenged because more important information is stored in multiple places in systems and networks on the Internet
• Convenience increases access to information for unauthorized users

Who are the hackers, why they do it and how?

• The lecture explains the different types of hackers, their motivations, and methods

Common Hacking Methodology

• Reconnaissance: Passively acquiring information about the intended system/network
• Scanning: Actively gathering information about the intended system/network
• Infiltration and escalation: Exploiting vulnerabilities
• Exfiltration: Accessing protected resources and data
• Access extension: Creating ways to support "future access"
• Assault: Removing/modifying critical files
• Obfuscation: Covering tracks to avoid detection

Hackers: Different Types

• "Good people": Information security professionals use hacking to uncover vulnerabilities
• Amateurs: Entry-level hackers using simple tools
• Criminals: Use malicious software and devices in criminal activities for financial gain
• Ideologues: Hack to achieve ideological or political goals
• Justifications include victimless crime, the Robin Hood ideal, national pride, educational value, or curiosity

Ethical Hacking

• Ethical hackers (white-hat hackers) engage in activities only with permission of the asset owner
• Penetration testing: structured, methodical means of investigating, identifying, attacking, and reporting on a system's strengths and vulnerabilities
• Black-box testing provides no knowledge of the system to ethical hackers

Why Ethical Hacking?

• To ensure confidentiality, integrity, and availability
• Confidentiality: only authorized subjects can access data (opposite of Disclosure)
• Integrity: only authorized subjects can modify data (opposite of Alteration)
• Availability: Info and resources available on demand to authorized subjects (opposite to Disruption)

Network Attacks

• The lecture explains the different types of Network Attacks

History of Systems/Networks Hacking

• 1960s-1970s: Hacking targeted mainframe computers that were not remotely accessible
• 1980s: PCs became widespread and worms and viruses became more common
• 1990s: Web attacks increased
• 2000s: Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks
• 2010s-2020s: Highly sophisticated tools used by groups of hackers, criminals, organizations, and foreign governments

Fundamental Question: Sources of Network Attacks?

• Network attacks can come from various points of entry, including servers, databases, routers, websites

Get a Firewall?

• Firewalls alone cannot stop all external attacks

Intrusion Detection System and Intrusion Prevention System

• Getting an Intrusion Detection System, or better, an Intrusion Prevention System, helps protect against network attacks

Problem With Network Attacks

• About 50% of attacks are internal
• Keep the firewall and find ways to stop internal attacks

Operation of a DDoS Attack

• A DDoS attack involves malicious traffic from attacker computers overwhelming a target server, causing a service offline outage

Future High Impact Attacks

• Taking down the entire Internet by targeting root DNS servers
• Interrupting the multi-country power grid by attacking computer-based control systems
• Controlling nuclear weapons of multiple countries
• Stealing financial information of 8 billion people
• Blocking global telephone/cellphone/satellite networks

Solutions Against Attacks

• Analyze the potential impact of major attacks
• Prioritize the systems and networks to protect
• Identify the vulnerabilities of systems and networks that can be used by attackers in the future
• Devise a plan to address these vulnerabilities
• Fix these vulnerabilities
• Monitor infrastructure and intervene as necessary

Possible Controls or Layers

• Organizations to protect themselves can use:
• Technical: Firewalls, proxies, intrusion detection and prevention systems, biometric authentication
• Administrative: Policies and procedures (like password)
• Physical Security: Locks, gates, cameras, guards, fences

Multi-Layer Security

• Makes it difficult for hackers to succeed (cyber-breach)
• Examples:
  • Layer 1: Firewalls to filter external attacks
  • Layer 2: Access Control for databases
  • Layer 3: Encryption of data

Swiss Cheese Model

• Illustrates multiple layers of defense where attacks can be blocked by different security layers

Binary to Decimal

• Details how to convert the binary number 10110011 to the decimal number 179

32 bits IP address to Dotted Decimal Notation

• Example: The 1st Octet 00111111, 2nd Octet 10101011, 3rd Octet 11101010, 4th Octet 10101011 converts to 63.171.234.171 in Dotted Decimal Notation

Linux Operating System

• The lecture introduces the basics of Linux Operating System

Linux

• Many tools available for IS security professionals
• Some for Windows Operating Systems but more for Linux
• Linux, evolved from Unix, is a different and quite powerful OS
• Kali is a specialized Linux distribution
• Portfolio of tools
• A complete operating system offering both Graphical User Interface (GUI) and Command Line Interface (CLI)
• Open source (generally free, but corporate versions that require support are not free)

Kali Linux

• Built on Debian distribution
• Designed for hacking or penetrating target networks and systems
• Used for testing and assessments
• Needs to know:
  • Interface (GUI, but lot with Command Line Interface)
  • Directory and files (e.g. /dev/hda1/file)
  • Commands (e.g. $ls -a)

Vital Directories

• /: root
• /bin: means binary (executable files)
• /boot: files to boot up Kali
• /dev: devices
• /etc: configuration files
• /home: user files
• /lib: library files (shared code)
• /usr: useful folders
• /var: system variables (print, mail, process)

Common Linux Commands

• ls (list)
• pwd (print working directory)
• cd (change directory)
• mkdir (make a directory)
• rmdir (remove directory)
• rm (remove or delete all)
• cp (copy)
• mv (move)

Live CDs/DVDs

• Kali Linux can be saved on a CD or DVD and run the system from there
• No need to install it on a computer
• Fully functional Operating System like if it were on the hard drive
• Used for:
  • Testing
  • Guest account
  • Repairing
  • Resetting passwords
  • Penetration testing

Virtual Machines

• Linux provides IS security professionals with a valuable set of tools as a Virtual Machine (VM)
• Kali is primarily used as a VM
• Linux can be run without installing it on a computer or boot from a CD/DVD
• No fee to pay
• Multiple VMs possible for different things

Things to think about

• If all network attacks are internal, what should be done?
• If all network attacks are external, what should be done?
• If the sources of attack aren't known, what should be done?
• Is it worth investing in Ethical Hacking to test weaknesses in a network/system?
• What role does education play in making a network secure?
• What are the advantages of learning Linux?

Reading Assignment

• O'Reilly Books: Fundamentals of Linux (Oliver Pelz)
  • Chapter 3: The Linux File System
  • Chapter 4: Working with Command Line

Lab 1: Creating and Securing User Accounts

• Register & pay at infoseclearning.com
• Complete Lab 1 before the next lecture
• You have 1 whole week to finish it!