Social Engineering Attacks

Social Engineering Attacks

• Social engineering attacks manipulate individuals into performing actions or divulging confidential information
• These attacks can be in-person, over the phone, or online

Types of Social Engineering Attacks

• Pretexting: A threat actor pretends to need personal/financial data to confirm a recipient's identity
• Phishing: A fraudulent email disguised as a legitimate source tricks the recipient into installing malware or sharing personal/financial data
• Spear Phishing: A targeted phishing attack tailored to a specific individual/organization
• Spam: Also known as junk mail, it is unsolicited email containing harmful links, malware, or deception
• Something for Something: Also called "Quid pro quo" where personal information is requested in exchange for a gift
• Baiting: Malware infected flash drives are left in public locations to be found and inserted into a computer, installing malware
• Impersonation: A threat actor pretends to be someone they are not in order to gain a victim's trust
• Tailgating: A threat actor closely follows an authorized person into a secure location
• Shoulder Surfing: A threat actor steals passwords/information by inconspicuously looking over someone's shoulder
• Dumpster Diving: A threat actor rummages through trash bins to find confidential documents

Social Engineering Toolkit

• The Social Engineering Toolkit (SET) helps security professionals create social engineering attacks for network testing

Denial of Service (DoS) Attacks

• DoS attacks interrupt network services for users, devices, or applications
• Overwhelming Quantity of Traffic: Sending an unmanageable amount of data to a network/host/application, slowing or crashing it
• Maliciously Formatted Packets: Sending a malformed packet to a host/application, causing the receiving device to run slowly or crash

Consequences of DoS Attacks

• DoS attacks interrupt communication
• They cause significant losses of time and money

Distributed Denial of Service (DDoS) Attacks

• DDoS attacks are similar to DoS attacks, but originate from multiple, coordinated sources
• A threat actor builds a network of infected hosts aka zombies
• The threat actor uses a command and control (CnC) system to send control messages to the zombies
• Zombies scan and infect more hosts with bot malware
• The collection of zombies is termed a botnet
• When ready, the threat actor uses the CnC system to make the botnet of zombies carry out DDoS attack

IPv4 and IPv6

• IP does not validate the source IP address in a packet
• Spoofing source IP addresses is possible, allowing threat actors to send false packets
• The other fields in the IP header can be tampered with
• It is important to understand the different fields in both the IPv4 and IPv6 headers

Common IP Related Attacks

• ICMP Attacks: Threat actors use ICMP echo packets (pings) to discover subnets/hosts, generate DoS floods, and alter routing tables
• Amplification and Reflection Attacks: Threat actors block legitimate users from accessing information/services using DoS/DDoS attacks
• Address Spoofing Attacks: Threat actors spoof the source IP address in a packet for blind/non-blind spoofing
• Man-in-the-Middle (MITM) Attacks: Threat actors position themselves to monitor, capture, and control communication between source and destination

ICMP Attacks Tactics

• Used for reconnaissance and scanning attacks
• Information-gathering attacks map network topology
• ICMP is used to discover active hosts, identify OS, and determine firewall states
• Also used for DoS attacks

Network Security with ICMP

• Strict ICMP access control list (ACL) filtering on the network edge avoids ICMP probing from the internet
• Security analysts detect ICMP attacks by checking captured traffic/log files
• Firewalls and intrusion detection systems (IDS) detect attacks and alert analysts

ICMP Messages Used by Hackers

• ICMP echo request and echo reply: Used for host verification and DoS attacks
• ICMP unreachable: Used for network reconnaissance and scanning attacks
• ICMP mask reply: Used to map an internal IP network
• ICMP redirects: Used to lure a target host to send all traffic through a compromised device that creates a MITM attack

Amplification and Reflection Attack Details and Prevention

• Threat actors use amplification and reflection techniques to create DoS attacks
• ICMP echo request messages are forwarded to many hosts, containing the victim's spoofed IP address
• All hosts reply to the victim's spoofed IP address to overwhelm it
• Resource exhaustion attacks can also consume a target host or network's resources

Address Spoofing Attacks

• Threat actors create packets with false source IP addresses
• This hides the identity of the sender / impersonates another user
• This can provide access to otherwise inaccessible data/circumvent security
• Often incorporated into other attacks, such as Smurf attacks

Types of Spoofing Attacks

• Non-blind Spoofing: Threat actor sees traffic between host and target and inspects packets to determine firewall state/sequence numbers/session hijacking
• Blind Spoofing: Threat actor cannot see the traffic and is usually used for DoS attacks

MAC Address Spoofing

• MAC address spoofing occurs when threat actors have access to the internal network
• They alter their host's MAC address to match a target host's known MAC address
• After the switch receives a frame, it examines the source MAC address

CAM Table Updates

• The switch overwrites the CAM table entry and assigns the MAC address to a new port
• Frames destined for the target host are sent to the attacking host

Application/Service Spoofing

• Application/Service spoofing is another spoofing example
• A threat actor connects a rogue DHCP server to create an MITM condition

TCP Segment Header Information

• Appears immediately after the IP header
• Includes fields and flags for the Control Bits
• URG: Urgent pointer field significant
• SYN: Synchronize sequence numbers
• ACK: Acknowledgement field significant
• PSH: Push function
• FIN: No more data from sender
• RST: Reset the connection

TCP Services

• Reliable Delivery: Acknowledgments guarantee delivery and retransmit missing data
• Flow Control: Manages data flow to avoid overwhelming the receiver
• Stateful Communication: Managed through a TCP three-way handshake

TCP Three-Way Handshake Steps

• Initiating client requests a client-to-server communication session with server
• The server acknowledges the client-to-server communication session and requests a server-to-client communication session
• The initiating client acknowledges the server-to-client communication session

TCP Attacks

• Network applications use TCP or UDP ports
• Threat actors conduct port scans of target devices to discover which services they offer

TCP SYN Flood Attack

• Exploits the TCP three-way handshake
• The attack continually sends TCP SYN session request packets with a randomly spoofed source IP address to a target
• The target devices replies with a TCP SYN-ACK packet to the spoofed IP address and waits for a TCP SYN-ACK packet to the spoofed IP address and waits for a TCP ACK packet
• Those responses never arrive
• Eventually the target host is overwhelm with half-open TCP connections
• TCP services are denied to legitimate users

Syn Flood Attack Details

• The threat actor sends multiple SYN requests to a web server
• The web server replies with SYN-ACKs for each SYN request and waits to complete the three-way handshake
• The threat actor does not respond to the SYN-ACKs, and a valid user cannot access the web server because the server is occupied with the half-open connections

TCP Reset Attack

• A TCP reset attack terminates TCP communications between two hosts in either a civilized or non-civilized manner
• Civilized: uses a four-way exchange with FIN and ACK segments
• Uncivilized: a host receives a TCP segment with the RST bit set, abruptly tearing down the connection

Terminating a TCP Connection Steps

• The client sends a segment with the FIN flag set when has no more data to send in the stream
• The server sends an ACK to acknowledge the receipt of the FIN to terminate the session from client to server
• The server sends a FIN to the client to terminate the server-to-client session

TCP Session Hijacking

• TCP session hijacking is when a threat actor takes over an already-authenticated host
• To do the task you must spoof the IP address of one host, predict the next sequence number, and send an ACK to the other host
• The attacker will be able to send data from the target device but will not be able to read the data received by the target

UDP Segment Header and Operation

• UDP is used by DNS, TFTP, NFS, and SNMP as well as media streaming and VoIP
• A connectionless transport layer protocol, the UDP segment structure is smaller than TCP’s segment structure

UDP Attacks

• UDP is not protected by any encryption
• Anyone can see and change UDP traffic
• It is then sent to its destination
• Altering data changes the 16-bit checksum
• The checksum is optional
• The threat actor can create a new checksum based on the new data payload, and then record it in the header as a new checksum
• The destination device will find that the checksum matches the data without knowing that the data has been altered

UDP Flood Attacks

• UDP flood attacks consume all network resources
• A threat actor uses tools like UDP Unicorn or Low Orbit Ion Cannon
• These tools send a flood UDP packets, often from a spoofed host, to a server on the subnet
• The program sweeps through open ports trying to find a closed port
• This causes the server to reply with an ICMP port unreachable message and creates traffic on the bandwidth
• The result is very similar to a DoS attack