2. Security Threats and Attacks

Security Threats and Attacks

Passive Attacks

Passive attacks

Passive attacks attempt to use information from the system by external bodies that do not affect system resources.

Link to original

Active Attacks

Active attacks

Active attacks attempt to intercept existing streams of information and use tactics such as:

• Masquerade: Replacing the peer that a user is trying to connect to / pretending to be another machine.
• Replay: Messages are resent to try to either break or gain access to a system.
• Modification of messages: Pass all data through themselves and take or modify any data they wish to.

Link to original

Distributed Attacks

Distributed attack

A distributed attack is when code is injected into seemingly trusted software.

Link to original

Insider Attacks

Insider attack

Insider attacks occur when a seemingly trusted individual performs a malicious attack on a network they already are authorized to access.

Link to original

Social Engineering

Social engineering

Social engineering is the acquisition of security-sensitive information or unauthorised access privileges by an outside attacker, based upon the abuse of a trust relationship.

Human-based social engineering:

• Social engineer may call a help desk, the engineer will often know names of employees and lingo of the company.
• A social engineer may pretend to be an important user which means their request is less likely to be turned down, and they may threaten to report the employee to their supervisor if they don’t comply.
• The social engineer may have obtained the name of someone in the organisation who has authority to grant access information, and thereby pretend that they sent them.
• A social engineer may pretend to be someone from an infrastructure-support group.

Computer-based social engineering:

• Malware in mail attachments
• Websites which farm credentials
• Popup windows that farm information
• Fake wireless networks that could capture information
• Phishing: attackers use web-based services to launch attacks on devices connected to web to acquire various bits of information by masquerading as someone trustworthy within some electronic communication.
  • SMiShing: phishing over SMS
  • Vishing: phishing over VoIP

Link to original

Denial of Service

Denial-of-service attack

Denial-of-service attack: Flooding systems or servers with traffic to exhaust resources and bandwidth.

• Volume-based attacks:

  • UDP flood

    A UDP flood is a form of volumetric DoS attack where the attacker targets and overwhelms random ports on the host with UDP packets.

    Link to original

  • ICMP flood

    ICMP flood is a flood of ping requests. (ICMP echo request packets)

    Link to original

• Application attacks:

  • HTTP flood

    A HTTP flood is a Layer-7 application attack that uses botnets, attacker spams HTTP requests to host.

    Link to original

  • Slow Loris

    Slow Loris sends small portions of a HTTP request to a server. These are sent in timed intervals so the request does not time out, the server runs out of available connections.

    Link to original

• Protocol attacks:

  • TCP SYN flood

    TCP SYN flood is where an attacker sends seemingly normal SYN requests to a server which cause it to respond with SYN-ACK packets. This causes the target machine to slowly run out of memory as it waits for ACK packets from the attacker.

    Link to original

  • Ping of Death

    A Ping of Death is where an attacker tries to crash or freeze a server by sending a normal ping request that is either fragmented or oversized.

    Link to original

Link to original