Social Engineering Attacks

Social Engineering Attacks

• Social engineering is an access attack used to manipulate individuals into divulging confidential information or performing certain actions
• Techniques can be performed in person, over the phone or online

Social Engineering Attack Types

• Pretexting: A threat actor pretends to need personal or financial data to confirm the recipient's identity
• Phishing: A fraudulent email disguised as being from a legitimate source tricks the recipient into installing malware or sharing personal data
• Spear Phishing: A targeted phishing attack tailored for a specific individual or organization
• Spam: Unsolicited email, also known as junk mail, containing harmful links, malware, or deceptive content
• Something for Something or "Quid pro quo": A threat actor requests personal data in exchange for something such as a gift.
• Baiting: A threat actor leaves a malware-infected flash drive in a public location
• Impersonation: A threat actor pretends to be someone else to gain the victim's trust
• Tailgating: A threat actor quickly follows an authorized person into a secure location
• Shoulder Surfing: A threat actor steals passwords or other information by inconspicuously looking over someone's shoulder
• Dumpster Diving: A threat actor rummages through trash bins to find confidential documents

Social Engineering Toolkit (SET)

• A tool designed to assist white hat hackers and network security professionals in creating social engineering attacks for network testing purposes

Denial of Service (DoS) Attacks

• DOS attacks cause an interruption of network services
• Overwhelming Quantity of Traffic: A threat actor floods a network with data, causing slow response times or crashes
• Maliciously Formatted Packets: A threat actor sends a corrupted packet to a host, causing it to slow down or crash

Distributed Denial of Service (DDoS) Attacks

• Similar to a DoS attack, the DDoS attack comes from multiple, coordinated sources
• A threat actor builds a network of infected hosts (zombies) and uses a command and control, CnC system to control them
• Bot malware turns infected hosts into the zombies, which form a botnet
• The CnC makes the botnet conducts the DDoS attack

IPv4 and IPv6

• IP doesn't validate the source IP addresses, enabling threat actors to send packets using spoofed IP addresses
• Attackers tamper with IP headers
• Security analysts need to understand IPv4 and IPv6 headers

Common IP Related Attacks

• ICMP Attacks: Threat actors use Internet Control Message Protocol (ICMP) echo packets (pings) to discover subnets and hosts
• Amplification and Reflection Attacks: Threat actors use these attacks to prevent legitimate users from accessing services using DoS and DDoS attacks
• Address Spoofing Attacks: Threat actors spoof the source IP address in an IP packet to perform blind or non-blind spoofing
• Man-in-the-Middle (MITM) Attack: Threat actors position themselves between a source and destination to monitor, capture and control communication

ICMP Attacks in Detail

• Reconnaissance and scanning attacks are performed via ICMP
• Attackers map out network topology and discover active hosts
• ICMP identifies the host OS and determines firewall state
• ICMP can be used for DoS attacks

Strict ICMP Access Control List (ACL) Filtering

• Networks should have strict ICMP ACL filtering on the network edge to avoid ICMP probing from the internet
• Security analysts should be able to detect ICMP-related attacks by looking at captured traffic and log files
• Firewalls and Intrusion Detection Systems (IDS) automatically detect such attacks and generate alerts
• ICMP echo request and echo reply is is used to perform host verification and DoS attacks
• ICMP Unreachable is used for reconnaissance and scanning attacks
• ICMP Mask Reply maps an internal IP network
• ICMP Redirects lure a target host through a compromised device thus creating a MITM attack

Amplification and Reflection Techniques

• Threat actors create DoS attacks using amplification and reflection
• Amplification: Threat actors forwards ICMP echo request messages to many hosts using the victim’s spoofed source IP address
• Reflection: The hosts reply to the victim using the spoofed IP address to overwhelm it
• Resources exhaustion attacks consume the resources of a target host to either crash it or consume the resources of a network

Address Spoofing Attacks

• Threat actors create packets with false source IP addresses to hide their identity or impersonate a legitimate user
• Spoofing is incorporated into attacks such as Smurf attacks

Types of Spoofing Attacks

• Non-blind spoofing: The attacker can see the traffic being sent between the host and target and uses this to inspect reply packets and determine firewall state etc
• Blind spoofing: The attacker cannot see the traffic and is often used in DoS attacks

MAC Address Spoofing Attacks

• Threat actors alter the MAC address of their host to match a known address of a target host
• The attacking host sends a frame throughout the network with the newly-configured MAC address
• When the switch receives the frame, it examines the MAC address

CAM Table Manipulation

• The switch overwrites the current CAM table entry and assigns the MAC address to the new port, then forwards frames destined for the target host to the attacker
• This is another spoofing example

TCP Segment Header

• TCP segment information appears immediately after the IP header
• URG: Urgent pointer field significant
• SYN: Synchronize sequence numbers
• ACK: Acknowledgement field significant
• PSH: Push function
• FIN: No more data from sender
• RST: Reset the connection

TCP Services

• Reliable delivery: TCP incorporates acknowledgments to guarantee delivery
• Flow control: TCP implements flow control to address issues with guaranteed delivery
• Stateful communication: Two parties use TCP for stateful communication during the TCP three-way handshake

TCP Three-Way Handshake

• The initiating client requests a TCP connection to a server
• The server acknowledges the client and sends a request to the client to connect back to the server
• The client acknowledges the server, creating connection

TCP Attacks

• Network applications use TCP or UDP ports
• Threat actors use port scans to discover their services

TCP SYN Flood Attack

• Exploits the TCP three-way handshake by flooding the network with SYN requests aimed at a target
• The threat actor sends multiple TCP SYN session requests with a randomly spoofed source IP address to a target, flooding the target
• The target device gets overwhelmed by the amount of requests and eventually crashes

TCP Reset Attack

• Used to terminate TCP communications between hosts which can be done civilly or uncivilly
• A civil TCP connection closes using a four-way exchange using FIN and ACK segments from each TCP
• An uncivil TCP connection closure occurs when a host receives a TCP segment with the RST bit set to tear down the connection

Terminating a TCP Connection

• Client-side terminates the process
• The client has no more data to send in and sends a segment with the FIN flag set
• The server sends an ACK to acknowledge the receipt of the FIN to terminate the session from client to server, and vice versa

TCP Session Hijacking

• Attack that takes over already authenticated host to communicate with a target
• The threat actor spoofs the IP address of one host, predicts the next sequence number, and sends an ACK to the other host
• Data can be sent from the target device but can't be received by it

UDP Segment Header and Operation

• Commonly used by DNS, TFTP, NFS, SNMP, media streaming and VoIP
• Connectionless transport layer protocol with much lower overhead
• Does not offer retransmission, sequencing, and flow control for reliability

UDP Attacks

• Not protected by any encryption by default which means traffic can be inspected or changed
• Alterations change the checksum of the data, but the checksum is optional, and may not be used
• If it is used, the attacker can create a new checksum for the data

UDP Flood Attacks

• In a UDP flood attack, the resources on a network are consumed
• A tool is used that sends UDP packets from a spoofed host to a server on the subnet
• The program sweeps through all known ports trying to find closed ports, which triggers an ICMP port unreachable message, which creates additional traffic
• The result is very similar to a DoS attack