Howard Hudson - Week 11 - Awareness Helps Protect Against Attacks

Numerous threats will cause damage to a network. Devices, storage units, and the network itself are vulnerable to hackers. The initial attack can begin from any one of those three points. Dangers range from insider threats and poor access controls to unmanaged applications and viruses from outside the network.

One example of poor system security is “overlooked” system updates for software on your systems, which creates a weak point for hackers to access. It’s smarter to install patches on your systems than to risk leaving know (and unknown) vulnerabilities open for attack. Some of the specific threats include phishing, man in the middle, session hijacking, brute force, spoofing, de-authentication, and VLAN hopping

Phishing is just as it sounds. The perpetrator throws the bait (money) in the water (your email) and hopes you bite a bait (click the embedded link).

The man in the middle and session hijacking attacks are similar, but slightly different. The session hijacking scheme is where the perpetrator “listens” specifically for your authentication data and steals it to gain access to a device, database, or website. The man in the middle attack is where a perpetrator pretends to be the access point that you believe is legitimate. The perpetrator then receives all of your traffic and can steal any piece of information that is desirable.

A brute fore attack is exactly as it sounds. The attacker uses every known combination to guess the correct password or authentication in order to unlock and open a secured item such as an email account, database, or port on a network device.

A Spoofing attack is simulator to the man in the middle attack because they both revolve around pretending to be a legitimate entity, but spoofing isn’t focused on the “mediator”, but focused on the trick itself. An attacker can emulate an email account of a business or individual and send out emails (as the network manager, for example) telling everyone to authenticate their credentials.

The de-authentication attack is sneaky as well. Instead of being kicked off an access point because your lease expired, someone uses a legitimate de-authentication packet to maliciously kick you off in hopes that you will connect to the “next best thing”. Personally, I disable auto-connect on all of my devices if it is an option. I also don’t connect to public hotspots/Wi-Fi unless I talk to the person or company that manages it.

VLAN hopping is also a little scary. Essentially, the attacker tries to modify a VLAN by changing it to a trunk link. An article on TechTarget.com explains the VLAN hopping attack. One way an attacker can manipulate a switch is by using it's auto-trunking function, if its enabled, to gain access to other parts of the network. Another method is to send data through one switch to another switch by sending 802.1Q tags (IEEE VLAN standard). The victim switch that receives the malicious 802.1Q tag believes that the frame is intended for it, which is then sent to the victim port.

A good portion of these attacks can be mitigated by paying close attention to key details and ensuring your systems are correctly configured. Just take the extra time to do things right the first time.

Resources

Phifer, L. (2007, March). VLANs -- Controlling wired and wireless traffic. Retrieved February 23, 2019, from https://searchnetworking.techtarget.com/tip/VLANs-Controlling-wired-and-wireless-traffic

Rouse, M. (2005, November). VLAN hopping (virtual local area network hopping). Retrieved February 23, 2019, from https://searchsecurity.techtarget.com/definition/VLAN-hopping