Social Engineering Attacks

Social Engineering Attacks

• Social engineering is an access attack which aims to manipulate someone into divulging confidential information or performing certain actions
• Some social engineering techniques are performed in-person, while other exploits use the telephone or internet

Common Social Engineering Attacks

• Pretexting: A threat pretends needing personal or financial data to confirm the identity of the recipient
• Phishing: A threat actor sends fraudulent email disguised as being from a legitimate, trusted source to trick the recipient into installing malware or sharing personal information
• Spear phishing: A threat actor creates a phishing attack targeted and tailored specifically for an individual or organization
• Spam: Also known as junk mail, unsolicited email containing harmful links, malware, or deceptive content

Additional Social Engineering Attacks

• Something for Something: (Quid pro quo) A threat actor requests personal information from a party in exchange for something such as a gift
• Baiting: A threat actor leaves a malware-infected flash drive in a public location, a victim finds the drive and unsuspectingly inserts it into their laptop, unintentionally installing malware
• Impersonation: A threat actor pretends to be someone they are not to gain the trust of a victim
• Tailgating: A threat actor quickly follows an authorized person into a secure location to gain access to a secure area
• Shoulder Surfing: A threat actor inconspicuously looks over someone’s shoulder to steal their passwords or other information
• Dumpster Diving: A threat actor rummages through trash bins to discover confidential documents

Social Engineering Toolkit (SET)

• The Social Engineering Toolkit (SET) assists ethical hackers and network security professionals in creating social engineering attacks to test networks

Denial of Service (DoS) Attacks

• DoS attacks interrupt network services for users, devices, or applications
• Overwhelming Quantity of Traffic: An enormous amount of data from a threat actor overwhelms the network, host, or application, slowing down transmission and response times, or causing a crash
• Maliciously Formatted Packets: A maliciously formatted packet is sent to a host or application; the receiving device runs slowly or crashes as a result

Impact of DoS Attacks

• DoS attacks interrupt communication and cause loss of time and money

Distributed Denial of Service (DDoS) Attacks

• DDoS attacks are similar to DoS attacks, but they originate from multiple, coordinated sources
• A threat actor builds a network of infected hosts, known as zombies
• The threat actor uses a command and control (CnC) system to send control messages to the zombies, who constantly scan and infect more hosts with bot malware
• The bot malware makes the host a zombie that can communicate with the CnC system, the collection of zombies is called a botnet
• The threat actor instructs the CnC system to have the bot net of zombies launches a DDoS attack

IPv4 and IPv6 Vulnerabilities

• IP does not validate whether the source IP address in a packet actually came from that source
• Threat actors can send packets using a spoofed source IP address or tamper with other fields in the IP header
• Security analysts need to know the different fields in both IPv4 and IPv6 headers

Common IP Related Attacks

• ICMP Attacks: Threat actors use Internet Control Message Protocol (ICMP) echo packets (pings) to discover subnets and hosts on a protected network, generate DoS flood attacks, and alter host routing tables
• Amplification and Reflection Attacks: Threat actors attempt to prevent legitimate users from accessing information or services using DoS and DDoS attacks
• Address Spoofing Attacks: Threat actors spoof the source IP address in an IP packet to perform blind spoofing or non-blind spoofing
• Man-in-the-Middle Attacks (MITM): Threat actors position themselves between a source and destination to transparently monitor, capture, and control communication, eavesdropping by inspecting captured packets or altering packets and forwarding them

ICMP Attacks Explained

• Threat actors use ICMP for reconnaissance and scanning attacks to launch information-gathering attacks to map out a network topology
• Threat actors discover which hosts are active/reachable, identify the host operating system (OS fingerprinting), and determine the state of a firewall
• Threat actors use ICMP for DoS attacks

ICMP Access Control Lists (ACL)

• Networks should have strict ICMP access control list (ACL) filtering on the network edge to avoid ICMP probing from the internet
• Security analysts should be able to detect ICMP-related attacks by looking at captured traffic and log files
• Security devices such as firewalls and intrusion detection systems (IDS) detect attacks and generate alerts to security analysts
• ICMP Echo Request and Echo Reply are used to perform host verification and DoS attacks
• ICMP Unreachable is used to perform network reconnaissance and scanning attacks
• ICMP Mask Reply maps an internal IP network
• ICMP Redirects lure a target host into sending all traffic through a compromised device and create a MITM attack

Amplification and Reflection Attacks

• Threat actors use amplification and reflection techniques to create DoS attacks
• Amplification involves the threat actor forwarding ICMP echo request messages to many hosts, containing the source IP address of the victim
• Reflection involves those hosts replying to the spoofed IP address of the victim, overwhelming them
• Threat actors also use resource exhaustion attacks, consuming the resources of a target host to either crash it or consume the resources of a network

Address Spoofing Attacks

• IP address spoofing attacks are when a threat actor creates packets with false source IP address info to hide the identity of the sender or pose as a legitimate user
• The threat actor can then gain access to otherwise inaccessible data or circumvent security configurations
• Spoofing is often incorporated into another attack such as a Smurf attack

Types of Spoofing Attacks

• Non-blind spoofing: The threat actor can see the traffic being sent between the host and the target and uses non-blind spoofing to inspect the reply packet from the target victim
• Non-blind spoofing determines the state of a firewall and sequence-number prediction, and can hijack an authorized session
• Blind spoofing: The threat actor cannot see the traffic being sent between the host and the target, blind spoofing is used in DoS attacks

MAC Address Spoofing Attacks

• These are used when threat actors have access to the internal network
• Threat actors alter the MAC address of their host to match another MAC address of a target host
• The attacking host sends a frame throughout the network with the newly-configured MAC address
• When the switch receives the frame, it examines the source MAC address
• The switch overwrites the current CAM table entry and assigns the MAC address to the new port, and then forwards frames destined for the target host to the attacking host

Other application spoofing

• An application/service spoofing threat actor can connect a rogue DHCP server to create a MITM condition

TCP Segment Header

• TCP segment information appears immediately after the IP header
• The six control bits of the TCP segment:
  • URG (Urgent): Significant urgent pointer field
  • SYN (Synchronize): Synchronize sequence numbers
  • ACK (Acknowledgment): Acknowledgement field significant
  • PSH (Push): Push function
  • FIN: No more data from sender
  • RST: Reset the connection

TCP Services

• Reliable delivery: TCP uses acknowledgments to guarantee delivery, rather than upper layer protocols needing to detect and resolve errors
• If an acknowledgment is not received, the sender retransmits the data, but acknowledgments can cause substantial delays
• Examples of protocols that utilize TCP reliability: HTTP, SSL/TLS, FTP, DNS zone transfers
• Flow control: TCP implements flow control, rather than acknowledge with a single acknowledgment segment
• Stateful communication: TCP stateful communication occurs during the TCP three-way handshake

TCP Three-Way Handshake

• TCP connection is established in three steps:

1. Initiating client requests a client-to-server communication session with server
2. Server acknowledges the client-to-server communication session and requests a server-to-client communication session
3. Initiating client acknowledges the server

TCP Attacks

• Threat actors conduct port scans of target devices to see which services they offer
• TCP SYN Flood Attack: The attack exploits the TCP three-way handshake
• A threat actor continually sends TCP SYN session request packets with a randomly spoofed source IP address to a target
• The target devices reply with a TCP SYN-ACK packet to the spoofed IP address and waits for a TCP SYN-ACK packet
• The responses never arrive, the target host becomes overwhelmed with half-open TCP connections, and TCP services are denied to legitimate users
• A threat actor sends multiple SYN requests to a web server which replies with SYN-ACKs for each SYN request, and waits to complete the three-way handshake, but the threat actor never responds to complete handshake
• A valid user will not be able to access the web server

TCP Reset Attack

• TCP reset attack can terminate TCP communications in a civilized or uncivilized manner
• Civilized manner: When TCP uses a four-way exchange consisting of a pair of FIN and ACK segments from each TCP endpoint to close the TCP connection
• Uncivilized manner: A host receives an TCP segment with the RST bit set, abruptly tearing down the TCP connection and telling the receiving host to immediately stop using it

Terminating a TCP Connection

• Terminating a TCP session uses a four-way exchange process:

1. When the client has no more data to send in the stream, it sends a segment with the FIN flag set
2. The server sends an ACK to acknowledge the receipt of the FIN to terminate the session from client to server
3. The server sends a FIN to the client to terminate the server-to

TCP Session Hijacking

• TCP session hijacking is another TCP vulnerability
• A threat actor takes over an already-authenticated host communicating with the target
• The threat actor must spoof the IP address of one host, predict the next sequence number, and send an ACK to the other host
• If successful, the threat actor could send, but not receive, data from the target device

UDP Segment Header/Operation

• UDP is commonly used by DNS, TFTP, NFS, SNMP, or real-time applications (ex: media streaming/VoIP)
• UDP is a connectionless transport layer protocol which results in lower overhead than TCP as is not connection-oriented and lacks sophisticated retransmission, sequencing, and flow control
• The UDP segment structure is much smaller

UDP Attacks

• UDP is unencrypted by default, enabling anyone to see/change traffic
• Altering traffic changes the 16-bit checksum, but the checksum is optional and not always used
• When the checksum is used, a threat actor can make a new checksum based on the new data payload, and then record it in the header as a new checksum so that the destination device will find that the checksum matches the data without knowing the data has been altered

UDP Flood Attacks

• A UDP flood attack consumes all the resources on a network, this is often facilitated by a threat actor using tools like UDP Unicorn or Low Orbit Ion Cannon
• These tools send a flood of UDP packets, often from a spoofed host, to a server on the subnet
• The program will sweep through all the known ports trying to find closed port
• This causes the server to reply with an ICMP port unreachable message
• Because there are many closed ports on the server, this creates a lot of traffic on the segment, consuming most bandwidth
• Results are very similar to a DoS attack