Detection and Mitigation of Common Attacks

Detection and Mitigation of Common Attacks

Nota importada desde Inbox durante consolidacion bulk.

#Detection-and-Mitigation of #Common-Attacks

Denial of Service ( #DoS ) Attack:

#Ping-Flood: Overwhelms a target with excessive ping requests, overloading resources and preventing legitimate traffic.
#SYN-Flood: Exploits the three-way handshake by sending incomplete connection requests (SYN packets) without completing the handshake, leaving the server waiting for nonexistent responses.
#UDP-Flood: Bombards a target with User Datagram Protocol (UDP) packets, which are connectionless and don't require handshakes, further increasing resource consumption.
#Application-Layer-DoS: Targets specific vulnerabilities in web applications (e.g., slow database queries) to disrupt performance or crash them.

Security Solution:

  • Security Solution: DDoS Protection Services, Web Application Firewalls (WAFs), Intrusion Prevention Systems (IPS), and Traffic Analysis Tools

Detection:

  • Detection in SIEM: Anomalies in network traffic, such as a sudden increase in connection attempts or high bandwidth usage.
  • SIEM Solution Features: Threshold monitoring, anomaly detection, and real-time alerting based on abnormal patterns.

Mitigation:

  • Implement rate limiting to control the number of requests from a single source.
  • Use load balancing to distribute traffic across multiple servers.
  • Employ Content Delivery Networks (CDNs) to absorb and filter traffic.

Examples:

Ping Flood: An attacker floods a target server with a massive number of ICMP echo requests using a tool like "hping" or "ping-of-death," overwhelming its resources and causing it to become unresponsive.

SYN Flood: Attackers send a flood of TCP SYN packets, overwhelming the target's ability to complete the threeway handshake, and exhausting its connection resources.

HTTP GET Flood: An attacker uses automated tools to flood a web server with a large number of HTTP GET requests, consuming server resources and causing it to slow down or crash.

DNS Amplification: An attacker spoofs the source IP address and sends a small DNS query to an open DNS server, which, in turn, responds with a larger response to the forged source IP, amplifying the traffic directed at the target.

Distributed Denial of Service ( #DDoS) Attack:

#Botnets: Networks of compromised devices remotely controlled by attackers to launch coordinated DoS attacks, creating a larger flood of traffic compared to single-source DoS.
#Amplification-Attacks: Leverage vulnerable servers like DNS resolvers to amplify response packets to the target, exponentially increasing their impact.
#Reflective-Attacks: Craft packets in a way that makes them appear to originate from the target itself, redirecting the attack's impact back to the victim server.

Security Solution:

  • Security Solution: DDoS Protection Services, Content Delivery Networks (CDNs), and Traffic
    Scrubbing Services.

Detection:

  • Detection in SIEM: Unusual spikes in traffic from multiple sources, patterns consistent with known
    DDoS attack signatures.
  • SIEM Solution Features: Anomaly detection, correlation of traffic patterns, integration with DDoS
    protection services.

Mitigation:

  • Utilize DDoS protection services provided by cloud service providers.
  • Deploy appliances or services that specialize in detecting and mitigating DDoS attacks.
  • Configure firewalls to block known malicious IP addresses.

Examples:

Mirai Botnet: Compromised IoT devices, such as cameras and routers, are used collectively as a botnet to flood a
target with traffic, disrupting its services.

Man-in-the-Middle ( #MitM) Attack:

#ARP-Spoofing: Deceives devices on a network by providing false ARP (Address Resolution Protocol) responses, diverting traffic to the attacker's machine, allowing them to eavesdrop and potentially modify it.
#DNS-Spoofing: Intercepts or redirects DNS requests, leading users to malicious websites instead of the legitimate ones they intended to visit.
#SSL-tripping: Downgrades encrypted HTTPS connections to unencrypted HTTP, exposing sensitive data transmitted between the user and the website.

Security Solution:

  • Security Solution: SSL/TLS Encryption, Certificate Pinning, Network Monitoring Tools, Intrusion Detection/Prevention Systems (IDS/IPS).

Detection:

  • Detection in SIEM: Unexpected changes in network traffic or ARP/DNS discrepancies.
  • SIEM Solution Features: Network traffic analysis, log analysis, and anomaly detection for unexpected changes in communication patterns.

Mitigation:

  • Use encryption (SSL/TLS) to secure communication channels.
  • Implement secure Wi-Fi protocols (WPA3) for wireless networks.
  • Regularly monitor and update network configurations to detect unauthorized changes.

Examples:

ARP Spoofing: An attacker sends falsified Address Resolution Protocol (ARP) messages to associate their MAC
address with the IP address of a target, intercepting and manipulating the traffic.

DNS Spoofing: Manipulating DNS responses to redirect users from a legitimate website to a malicious one by
providing false IP address information.

SSL Stripping: Downgrading a secure HTTPS connection to an unencrypted HTTP connection, allowing the attacker
to intercept sensitive data.

Packet Sniffing:

#Passive-Sniffing: Captures network traffic without actively interacting with it, observing data exchanged between devices on the same network segment.
#Active-Sniffing: Employs techniques like ARP spoofing or packet injection to manipulate network traffic and capture data more deliberately.

Security solution:

  • Security Solution: Encryption (SSL/TLS, VPNs), Network Segmentation, Intrusion
    Detection/Prevention Systems (IDS/IPS).

Detection:

  • Detection in SIEM: Monitoring for unauthorized sniffing activities, and analyzing network traffic for
    abnormal patterns.
  • SIEM Solution Features: Log analysis, real-time monitoring, and detection of unusual network
    behavior.

Mitigation:

  • Encrypt sensitive data using protocols like SSL/TLS or VPNs.
  • Implement network segmentation to limit access to sensitive information.
  • Use intrusion detection/prevention systems to detect and block sniffing attempts.

Examples:

Wireshark: An attacker uses Wireshark to capture and analyze packets on a network, gaining unauthorized access
to sensitive information, such as login credentials.

Port Scanning:

#Port-scanning is a process used to identify open ports on a computer or network device. These ports represent potential entry points for communication and attackers use port scans to discover weaknesses and vulnerabilities. Each type of scan reveals different information:

#SYN-Scan:

  • Method: Sends a single SYN (Synchronize) packet to each port, mimicking the start of a three-way handshake (SYN, SYN-ACK, ACK).
  • Response:
    • Open port: Replies with a SYN-ACK packet, expecting an ACK in return (attacker doesn't respond to avoid full connection).
    • Closed port: Replies with an RST (Reset) packet, indicating the port is not listening.
    • Filtered port: No response, making it harder to determine if the port is open or closed.
  • Advantages: Faster than full scans, good for initial reconnaissance.
  • Disadvantages: Doesn't differentiate between open and filtered ports.

#ACK-Scan:

  • Method: Sends an ACK (Acknowledge) packet to each port, pretending to acknowledge a non-existent connection.
  • Response:
    • Open port: No response, as the port wasn't expecting an ACK.
    • Closed/filtered port: Replies with an RST (Reset) packet.
  • Advantages: Can sometimes identify open ports even if filtered by firewalls.
  • Disadvantages: Slower than SYN scans, might trigger security alerts on some systems.

#XMAS-Scan:

  • Method: Sends a packet with all flags set (FIN, PSH, URG) except SYN and ACK, looking for unusual responses.
  • Response:
    • Open port: Might respond with an RST or unexpected packet, revealing its presence.
    • Closed/filtered port: Usually replies with an RST.
  • Advantages: Can bypass some firewalls, less common than SYN/ACK scans.
  • Disadvantages: Slow, doesn't definitively identify open ports, might trigger security alerts.

Other Scanning Techniques:

  • #UDP-Scan: Similar to SYN/ACK scans but uses UDP packets, faster but doesn't reveal as much information.
  • Full Connect Scan: Establishes full TCP connections, slow but most accurate way to identify open ports.

Security Solutions:

  • Security Solution: Firewalls, Intrusion Detection/Prevention Systems (IDS/IPS), Regular Security Audits.

Detection:

  • Detection in SIEM: Unusual connection attempts to various ports, repeated scanning activities.
  • SIEM Solution Features: Log analysis, correlation of events, and real-time alerting for suspicious port scanning activities.

Mitigation:

  • Configure firewalls to block or rate limit suspicious scanning activities.
  • Regularly audit and close unnecessary open ports.
  • Implement intrusion detection/prevention systems to detect and block port scanning.

Examples:

Nmap SYN Scan: An attacker uses Nmap to perform a SYN scan, identifying open ports on a target system and
potential vulnerabilities.

SQL Injection:

#SQL-Injection: Inserts malicious SQL code into web application inputs to manipulate the database, potentially retrieving sensitive data, modifying information, or executing arbitrary commands.
#Blind-SQL-Injection: Detects the presence of a vulnerability without directly observing database responses, often relying on timing-based techniques or error messages.

Security Solution:

  • Security Solution: Web Application Firewalls (WAFs), Input Validation, Parameterized Queries, Secure Coding Practices.

Detection:

  • Detection in SIEM: Anomalies in database activity, unexpected query patterns.
  • SIEM Solution Features: Log analysis of database activities, pattern recognition, and correlation with other events.

Mitigation:

  • Use parameterized queries to prevent SQL injection.
  • Implement input validation and sanitize user inputs.
  • Regularly audit and patch database systems.

Examples:

Injecting Malicious SQL Code: Inputting SQL code into a web form to manipulate a database, potentially gaining unauthorized access or extracting sensitive information.

Cross-site Scripting (XXS):

#Stored-XSS: Malicious scripts are permanently injected into a website's database, affecting all visitors who view the affected page.
#Reflected-XSS: Exploits user inputs like search queries or comments, reflecting the malicious script back to the user's browser for immediate execution.
#DOM-based-XSS: Modifies the Document Object Model ( #DOM) of a webpage on the client-side, often through JavaScript vulnerabilities, to inject malicious scripts.

Security Solution:

  • Security Solution: Content Security Policy (CSP), Input Validation, Web Application Firewalls (WAFs).

Detection:

  • Detection in SIEM: Unusual web application behavior, logs indicating malicious script injection.
  • SIEM Solution Features: Log analysis, integration with WAFs, and detection of abnormal web application activities.

Mitigation:

  • Employ a Content Security Policy (CSP) to control script execution.
  • Input validation and output encoding to prevent script injection.
  • Regularly update and patch web applications.

Examples:

Script Injection: Embedding malicious scripts in user-generated content on a website, which execute in other users'
browsers, stealing cookies or defacing pages.

Cross-Site Request Forgery (CSRF):

Same-Site #CSRF: Targets actions within the same website, tricking a logged-in user into unintentionally performing unauthorized actions.
Cross-Site Request #Forgery with Token: Mitigates Same-Site CSRF by using anti-CSRF tokens that must be included in each request, preventing unauthorized actions without the correct token.

Security Solution:

  • Security Solution: Anti-CSRF Tokens, SameSite Cookie Attribute, Input Validation.

Detection:

  • Detection in SIEM: Unusual patterns in web requests, identification of unauthorized transactions.
  • SIEM Solution Features: Log analysis, monitoring of web application logs, and detection of CSRF indicators.

Mitigation:

  • Implement anti-CSRF tokens in web applications.
  • Use the SameSite cookie attribute to prevent CSRF attacks.
  • Validate and secure user sessions.

Examples:

Unauthorized Form Submission: Forcing a logged-in user to submit a form that changes their email address or password without their knowledge.

Phishing Attacks:

#Phishing: Form of social engineering attack where attackers try to deceive you into revealing sensitive information, such as passwords, credit card details, or personal data.
#Spear-Phishing: Highly targeted email attacks tailored to specific individuals or organizations, often impersonating trusted entities.
#Vishing: Phishing attacks conducted over the phone, attempting to trick victims into revealing sensitive information.
#Smishing: Phishing attacks delivered via text messages (SMS), aiming to trick victims into clicking malicious links or divulging personal data.

Security Solution:

  • Security Solution: Email Filtering, Anti-Phishing Software, User Training and Awareness, Domainbased Message Authentication, Reporting, and Conformance (DMARC).

Detection:

  • Detection in SIEM: Analysis of email logs, and identification of phishing indicators.
  • SIEM Solution Features: Email log analysis, correlation with threat intelligence feeds, and user behavior analytics.

Mitigation:

  • Implement email filtering solutions to detect and block phishing emails.
  • Educate users through security awareness training.
  • Use Domain-based Message Authentication, Reporting, and Conformance (DMARC) to authenticate email sources

Examples:

Deceptive Email: Sending emails that appear to be from a trusted source, tricking users into clicking on malicious links,
or providing sensitive information.

DNS spoofing/ Cashe Poisoning:

#DNS-Spoofing: Redirects users to malicious websites by altering DNS responses, often using techniques like ARP spoofing.
#DNS-Cache-Poisoning: Exploits vulnerabilities in DNS servers to store incorrect information, directing users to unintended destinations.

Security Solution:

  • Security Solution: DNS Security Extensions (DNSSEC), DNS Filtering, Regular DNS Monitoring.

Detection:

  • Detection in SIEM: Unusual DNS responses, and unexpected changes in DNS records.
  • SIEM Solution Features: DNS log analysis, real-time monitoring, and integration with DNS security
    solutions.

Mitigation:

  • Implement DNS Security Extensions (DNSSEC) to authenticate DNS responses.
  • Regularly monitor and audit DNS configurations.
  • Use DNS filtering services to detect and block malicious domains.

Examples:

Scenario 1: Direct Spoofing:

  1. The Attacker: An attacker positions themselves between your computer and the internet's DNS servers.
  2. Intercepting Your Request: When you type "an url" and your computer queries the DNS server, the attacker intercepts the request.
  3. Sending False Information: The attacker sends you a fake response claiming "that url" has a different IP address (attacker's own server).
  4. Misdirected Visit: Your computer, trusting the response, connects to the attacker's server instead of the real bank website.
  5. Data Theft: The attacker's website might look like the real bank, capturing your login credentials or other sensitive information.

Scenario 2: DNS Cache Poisoning:

  1. Targeting the DNS Server: The attacker exploits a vulnerability in a DNS server and injects false information about "an url" into its cache.
  2. Widespread Impact: Now, anyone using this DNS server (potentially many users) is directed to the attacker's server whenever they try to access the bank website.
  3. Similar Consequences: Just like in direct spoofing, users unknowingly visit the attacker's website, potentially compromising their information.

Key Takeaways:

  • Both scenarios lead users to malicious websites instead of the intended ones.
  • Spoofing can be targeted (Scenario 1) or widespread (Scenario 2) depending on the attack method.
  • Staying vigilant and using secure websites with HTTPS encryption can help mitigate these risks.

Eavesdropping:

#Passive-Eavesdropping: Intercepts data without interfering with the communication, typically targeting unencrypted channels.
Active #Eavesdropping: Injects devices or modified packets into the communication, potentially disrupting it while gathering information.

Security Solution:

  • Security Solution: Encryption (SSL/TLS, VPNs), Secure Wi-Fi Protocols (WPA3), Network Monitoring Tools.

Detection:

  • Detection in SIEM: Monitoring for unauthorized interception, and analyzing network traffic for signs of #eavesdropping.
  • SIEM Solution Features: Network traffic analysis, intrusion detection, and monitoring for unusual network behavior.

Mitigation:

  • Use encryption (SSL/TLS, VPNs) to secure sensitive communication.
  • Regularly monitor and audit network traffic for unusual patterns.
  • Implement secure Wi-Fi protocols and strong access controls.

Examples:

Unauthorized Wi-Fi Interception: Capturing unencrypted Wi-Fi traffic using tools like Wireshark to eavesdrop on sensitive data, such as login credentials.

Zero-Day Exploits:

Attacks that exploit #Zero-Day #vulnerabilities in software or systems before the vendor releases a patch, making them particularly dangerous as there's no immediate defense.

Security Solution:

  • Security Solution: Intrusion Detection/Prevention Systems (IDS/IPS), Endpoint Protection (Antivirus, EDR), Regular Software Patching, Vulnerability Scanning.

Detection:

  • Detection in SIEM: Anomalies in system or application logs, patterns consistent with known exploit techniques.
  • SIEM Solution Features: Log analysis, correlation with threat intelligence feeds, and behavior analytics to identify suspicious activities.

Mitigation:

  • Regularly update and patch software to address known vulnerabilities.
  • Employ intrusion detection/prevention systems to detect and block suspicious activities.
  • Implement application firewalls to filter and monitor incoming traffic.

Examples:

Exploiting Unknown Vulnerability: Leveraging a previously undisclosed vulnerability in a software application before a patch is released, allowing unauthorized access or system manipulation