024 Network and Service Security - 024.2 Network and Internet Security (weight: 3)

Local Network Attacks

• Networks are central to data transmission and are vulnerable to various attacks aimed primarily at data interception.
• Other goals include influencing communication and exploiting network access for unauthorized activities against third parties.
• Access to network transmission media is essential for data snooping, known as Link Layer Access; accessibility varies by medium and network configuration.

Wired Network Security

• Physical access to network ports is required to connect to wired networks, often widely distributed in buildings.
• Only necessary network ports should be activated, and configurations may require authentication for usage.
• Once a device connects to a network, it can be addressed by other devices; caution is advised when connecting to unknown networks.

WLAN Security

• WLANs transmit data wirelessly, making signals susceptible to interception by anyone within range.
• Cleartext transmissions should be treated as public, emphasizing the need for encryption of WLAN data.

WLAN Encryption Standards

• WEP (Wired Equivalent Privacy): An outdated, insecure standard that is easily attacked.
• WPA (Wi-Fi Protected Access): A successor to WEP that is currently considered secure.
• WPA2: The modern standard utilizing advanced cryptographic measures, supporting both shared and individual access modes.

Public WLAN Risks

• Public WLANs, often found in cafes and public transport, may lack encryption, leaving data exposed during transmission.
• Access typically redirects users to a "Captive Portal," where agreement to terms is required for access.
• Common passwords for such networks can facilitate attacks, as multiple users share the same access credentials.

Risks of Connecting to Unknown Networks

• Connecting to an unknown network may enable other participants to establish connections with the device and access hosted services.
• Attackers can mimic existing networks (ex: restaurants) to trick users into connecting, utilizing common passwords to gain access.

Internet Attacks

• Data interception can happen at various points in the transmission process, including routers, switches, and access points.
• Attacks like Man in the Middle (MitM) can occur when an attacker captures and possibly alters traffic between two parties.

Man in the Middle Attacks (MitM)

• In MitM scenarios, attackers can intercept unencrypted communications, capturing sensitive information like login credentials.
• Multiple methods exist for MitM attacks, including physical network access, eavesdropping on wireless traffic, or controlling network infrastructure.

Denial of Service Attacks (DoS)

• DoS attacks aim to disrupt the service of the targeted system, potentially through causing crashes or manipulating data.
• Disruption methods include severing access to networks or databases, leading to usability issues.

Distributed Denial of Service Attacks (DDoS)

• DDoS attacks utilize multiple systems to overwhelm a target with a flood of requests, seeking to exhaust network capacity.
• Such attacks typically involve thousands of compromised machines working collectively.

Botnets

• Botnets consist of numerous compromised computers under a single control entity, often used for executing DDoS attacks.
• Computers are infected via malware or by exploiting vulnerabilities, connecting to a command server for instructions.
• Besides DDoS attacks, botnets can facilitate spam distribution, data exchange, and as intermediaries for further attacks.

Packet Filtering

• Internet-connected systems are continuously targeted for vulnerabilities, with automated scans for weaknesses in services advertised via DNS.
• Packet filters use IP addresses and ports to manage the flow of data packets, allowing or rejecting traffic on routers, helping to block illegitimate access before it reaches the network.